What is the CVSS score of CVE-2026-9921?

CVE-2026-9921 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9921?

Yes, a patch is available for CVE-2026-9921. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9921

EUVD-2026-33216 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-05-28 Chrome

GHSA-2c8f-3q8j-hh53

Google Information Disclosure Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:26 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 4.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin information via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin information disclosure in Google Chrome for Android allows a remote attacker to leak sensitive cross-origin data by luring a victim to a crafted HTML page that exploits uninitialized memory in the WebGL implementation. Affected are all Chrome for Android releases prior to 148.0.7778.216. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV), with EPSS at 0.03% (10th percentile) reflecting minimal current exploitation activity.

Technical ContextAI

WebGL (Web Graphics Library) is a browser-native JavaScript API for hardware-accelerated 2D/3D graphics, implemented in Chrome's GPU process. CWE-457 (Use of Uninitialized Variable) describes a condition where a variable or memory buffer is consumed before being explicitly assigned a value, meaning it may retain residual data from prior allocations - in this context, potentially cross-origin GPU or CPU memory contents. On Android, Chrome's WebGL pipeline interacts closely with the device GPU driver, and memory isolation between origins relies on correct initialization. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scopes this to the Chrome application broadly, but the description explicitly constrains exploitation to the Android platform, indicating a platform-specific code path or GPU driver interaction in the Android WebGL implementation.

RemediationAI

Update Google Chrome for Android to version 148.0.7778.216 or later, which contains the vendor-released patch as confirmed via the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. The update is delivered through the Google Play Store; ensure automatic updates are enabled on managed Android devices. For organizations that cannot immediately patch, compensating controls include restricting WebGL access via enterprise policy (setting 'WebGLEnabled' to false through Chrome's managed device policies) - note this will break WebGL-dependent web applications. Alternatively, restrict browsing to known-safe URLs via allowlist policies to reduce exposure to crafted pages. There is no indication of a workaround that preserves full functionality while mitigating this specific flaw.