What is the CVSS score of CVE-2026-9929?

CVE-2026-9929 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9929?

Yes, a patch is available for CVE-2026-9929. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9929

EUVD-2026-33224 MEDIUM

Information Exposure (CWE-200)

2026-05-28 Chrome

GHSA-p6jh-cg8g-r46m

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:26 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 4.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's WebGL implementation on Android allows remote unauthenticated attackers to exfiltrate sensitive cross-origin content from a victim's browser session. Affected are all Chrome for Android releases prior to 148.0.7778.216. Exploitation requires the victim to visit a crafted HTML page, but no prior privileges or authentication are needed on the attacker's side. No public exploit identified at time of analysis and EPSS remains at 0.03%, indicating low automated or widespread exploitation pressure.

Technical ContextAI

WebGL (Web Graphics Library) is a JavaScript API that grants web pages direct access to GPU-accelerated 2D and 3D graphics rendering via OpenGL ES. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, narrowed by the description to the Android platform specifically. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the WebGL implementation incorrectly permits a sandboxed web origin to observe or infer pixel or buffer data belonging to a different origin. This class of flaw typically manifests as a timing or readback side-channel in GPU texture handling or framebuffer operations, where the same-origin policy is not enforced at the GPU layer with the same rigor as the DOM layer. The Android-specific scope suggests the vulnerability may relate to platform-level GPU driver interactions or Android's GPU memory management that differ from desktop Chrome behavior.

RemediationAI

Update Google Chrome on Android to version 148.0.7778.216 or later, which contains the vendor-released patch per the official Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Updates can be applied via the Google Play Store on Android devices. For enterprise environments managing Android devices via MDM, push the update through the managed Chrome update policy. As a compensating control for deployments where immediate patching is not feasible, restricting user access to untrusted or unknown web pages via enterprise browser policy (URL allowlisting) would reduce exposure, with the trade-off of limiting general web browsing. Disabling WebGL via Chrome enterprise policy (--disable-webgl flag or WebGL policy setting) would eliminate the attack vector entirely at the cost of breaking web applications dependent on GPU-accelerated graphics. No additional workarounds are documented in the referenced advisory.