What is the CVSS score of CVE-2026-9908?

CVE-2026-9908 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9908?

Yes, a patch is available for CVE-2026-9908. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9908

EUVD-2026-33203 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-7wvw-2qw6-j239

Google Information Disclosure Buffer Overflow Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:24 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 6.5

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read in Chrome's ANGLE graphics layer exposes process memory contents to unauthenticated remote attackers who can lure a user to a crafted HTML page. All Google Chrome desktop versions prior to 148.0.7778.216 are affected, with the vulnerability carrying a CVSS 6.5 and exclusively a confidentiality impact - no integrity or availability loss. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (11th percentile) reflects low current exploitation activity, consistent with a typical Chrome graphics-component disclosure ahead of a stable channel patch.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Google's cross-platform graphics abstraction library, used by Chrome to translate OpenGL ES calls into platform-native APIs such as Direct3D on Windows, Metal on macOS, and Vulkan. CWE-125 (Out-of-bounds Read) indicates the root cause: a read operation that exceeds the bounds of an allocated memory buffer, typically arising from missing or incorrect length checks when processing attacker-controlled graphics data embedded in an HTML page. Because ANGLE operates within the renderer process, successfully triggering the read can expose memory contents from that process - potentially including cached page content, session tokens, or other in-process data. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to the 148.0.7778.216 stable channel release. The vendor-assigned Chromium security severity is High.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.216 or later, which is the vendor-confirmed patched release per the stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's auto-update mechanism will apply this patch in most managed and consumer environments; verify the running version via chrome://settings/help. If immediate upgrade is blocked by organizational policy, a compensating control is to restrict users from browsing untrusted or external websites through URL filtering or browser isolation proxies - note this may impact productivity and does not eliminate risk from compromised trusted sites. Enterprise administrators using Chrome policies can consider enabling Enhanced Safe Browsing as an additional signal layer, though this does not patch the underlying OOB read. No workaround eliminates the vulnerability without upgrading.