What is the CVSS score of CVE-2026-9920?

CVE-2026-9920 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9920?

Yes, a patch is available for CVE-2026-9920. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9920

EUVD-2026-33215 LOW

Use of Uninitialized Variable (CWE-457)

2026-05-28 Chrome

GHSA-9gf2-vxp3-r9rg

Google Information Disclosure Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:26 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

3.1 (LOW)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data disclosure in Google Chrome on Android (prior to 148.0.7778.216) stems from uninitialized GPU memory that a renderer-compromised attacker can read via a crafted HTML page. This is a second-stage, chained vulnerability - exploitation requires that the renderer process has already been compromised through a separate, unspecified vector. CVSS rates this Low (3.1) consistent with the constrained impact (C:L only) and high attack complexity; EPSS of 0.03% (11th percentile) confirms no public exploit identified at time of analysis.

Technical ContextAI

CWE-457 (Use of Uninitialized Variable) in Chrome's GPU process on Android. The GPU component processes rendering commands from the renderer process; when GPU memory buffers are not properly initialized, they may retain residual data from prior operations belonging to different origins. Because the GPU process handles content from multiple origins in a shared memory space, uninitialized reads can expose cross-origin data to a compromised renderer. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped to Chrome on Android, versions prior to 148.0.7778.216. CWE-457 class vulnerabilities in GPU drivers are particularly sensitive because GPU memory is not subject to the same OS-level memory isolation guarantees as CPU memory.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216. Users and administrators should update Google Chrome on Android to version 148.0.7778.216 or later via the Google Play Store or Chrome's built-in update mechanism. The fix is documented in the Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and technical details are tracked in Chromium issue https://issues.chromium.org/issues/500138014. Because exploitation requires a prior renderer compromise, environments that already enforce restricted browsing (e.g., managed Android profiles blocking arbitrary web browsing) reduce - but do not eliminate - risk. No workaround that prevents GPU uninitialized memory reads without patching has been identified; the primary compensating control is preventing renderer compromise via timely patching of all Chrome components.