What is the CVSS score of CVE-2026-9930?

CVE-2026-9930 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9930?

Yes, a patch is available for CVE-2026-9930. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9930

EUVD-2026-33225 MEDIUM

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-f844-6jvw-2mjm

Google Memory Corruption Buffer Overflow Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:26 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

4.3 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 4.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds write in Dawn in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds memory write in Dawn, Chrome's WebGPU implementation, affects Google Chrome on macOS prior to version 148.0.7778.216. Remote unauthenticated attackers (per CVSS PR:N) can trigger the write via a crafted HTML page requiring only a single user interaction - visiting a malicious site. The CVSS-scored impact is constrained to low integrity (I:L), with no confidentiality or availability impact confirmed, suggesting the write primitive is limited or difficult to weaponize for full code execution without chaining additional exploits. No public exploit identified at time of analysis and EPSS at 0.03% (11th percentile) indicates very low exploitation probability.

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU graphics API, used to expose GPU acceleration to web content. CWE-787 (Out-of-bounds Write) indicates a memory safety failure where a write operation crosses the intended buffer boundary, typically caused by insufficient bounds checking on attacker-controlled input such as GPU buffer indices, shader parameters, or texture dimensions. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* constrained to macOS. Dawn operates within the GPU process in Chrome's multi-process architecture, meaning a successful exploit would initially achieve code execution in the GPU process rather than directly in the browser process or OS - further sandbreaking would be required for full system compromise. The platform restriction to Mac suggests a macOS-specific code path or memory allocator behavior triggers the condition.

RemediationAI

The vendor-released patch is Chrome version 148.0.7778.216 for macOS, confirmed via the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Users and administrators should update Chrome on all managed macOS endpoints to 148.0.7778.216 or later immediately, verifiable via chrome://settings/help. As a compensating control prior to patching, organizations can restrict access to untrusted external websites via network policy or disable WebGPU via the enterprise policy flag DisableWebGPU (chrome://flags/#enable-unsafe-webgpu set to Disabled), though this will break WebGPU-dependent web applications. The Chromium issue tracker reference is https://issues.chromium.org/issues/501499832 for technical detail.