What is the CVSS score of CVE-2026-9912?

CVE-2026-9912 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9912?

Yes, a patch is available for CVE-2026-9912. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9912

EUVD-2026-33207 MEDIUM

Information Exposure (CWE-200)

2026-05-28 Chrome

GHSA-h3hq-57r4-h32w

Google Information Disclosure Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:24 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 6.5

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

GPU memory disclosure in Google Chrome on Android (versions prior to 148.0.7778.216) exposes potentially sensitive process memory to unauthenticated remote attackers via crafted HTML pages. The root cause is an inappropriate implementation within Chrome's GPU subsystem on Android, classified as CWE-200, which permits out-of-bounds or unauthorized memory reads during rendering operations. No public exploit code exists and no active exploitation is confirmed; EPSS probability sits at a low 0.03%, though the Android-only scope and requirement for user interaction are the primary limiting factors rather than intrinsic exploitation difficulty.

Technical ContextAI

The vulnerability resides in Chrome's GPU process on Android, which handles hardware-accelerated rendering via APIs such as WebGL, Canvas, and related GPU-backed interfaces. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the flaw allows memory content accessible to the GPU process to be read and returned to an attacker-controlled context without authorization. The 'inappropriate implementation' language used by the Chromium team typically signals a logic or boundary error in how GPU memory buffers are allocated, shared, or validated - rather than a classic buffer overflow - potentially enabling cross-process or cross-origin memory disclosure. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with the EUVD narrowing the affected range to all Chrome releases below 148.0.7778.216 on Android. Desktop and other non-Android Chrome builds are not listed as affected.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 on Android. Update Chrome on Android to version 148.0.7778.216 or later via the Google Play Store or Chrome's built-in update mechanism; the fix is confirmed available per the stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. If immediate patching is not feasible in a managed fleet, a compensating control is to restrict or block navigation to untrusted external websites via a mobile MDM policy or DNS filtering, accepting the trade-off of reduced browsing functionality. Disabling JavaScript would also block the crafted HTML vector but severely degrades usability and is not recommended as a standing control. Enterprise administrators should prioritize pushing the Chrome 148.0.7778.216 update to Android devices as the primary and lowest-friction remediation.