What is the CVSS score of CVE-2026-9939?

CVE-2026-9939 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9939?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability in the WebCodecs renderer component that could allow attackers to execute arbitrary code within the…. A patch is available.

How to fix or mitigate CVE-2026-9939?

Within 24 hours: Inventory all Chrome deployments and identify systems running versions prior to 148.0.7778.216. Within 7 days: Deploy Chrome 148.0.7778.216 or later across all affected systems and verify automatic updates are enabled. Within 30 days: Audit deployment compliance, verify patch installation rates exceed 95%, and review endpoint telemetry for any exploitation attempts.

Google Chrome CVE-2026-9939

EUVD-2026-33081 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-28 Chrome

GHSA-c7jh-hgv7-r6m2

RCE Buffer Overflow Google Heap Overflow

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:30 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome prior to 148.0.7778.216 allows a remote attacker to execute arbitrary code within the renderer sandbox by tricking a user into visiting a crafted HTML page that triggers a heap buffer overflow in the WebCodecs component. Chromium rates this severity High and a vendor patch is available, though EPSS exploitation probability is currently very low (0.03%, 9th percentile) and there is no public exploit identified at time of analysis.

Technical ContextAI

The flaw resides in WebCodecs, a browser API that exposes low-level encoders and decoders for audio and video streams to JavaScript, enabling efficient media manipulation in the renderer process. CWE-122 (Heap-based Buffer Overflow) indicates the issue is a memory corruption bug where attacker-controlled data is written past the bounds of a heap allocation, almost certainly while parsing or processing crafted media payloads supplied through the WebCodecs interface. The CPE cpe:2.3:a:google:chrome confirms the affected component is Chrome itself (and by extension Chromium-derived browsers that import the same WebCodecs implementation), and exploitation occurs inside the renderer process which is constrained by Chrome's site isolation sandbox.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.216 or later on the Stable Desktop channel, as documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html; enterprise administrators should push the update via Chrome Browser Cloud Management, Group Policy, or their MDM/EMM platform and verify version compliance. Users of Chromium-derived browsers (Edge, Brave, Opera, Electron-based apps) should apply the corresponding vendor release that incorporates the upstream Chromium fix tracked in https://issues.chromium.org/issues/502735235. As an interim compensating control where patching is delayed, deploy enterprise policies to disable WebCodecs (chrome://flags or origin-restricted policy) or block untrusted browsing through DNS/web-proxy filtering - note that disabling WebCodecs will break legitimate sites relying on low-latency media (video conferencing, cloud gaming, streaming editors).