What is the CVSS score of CVE-2026-9942?

CVE-2026-9942 has a contested CVSS base score of 5.0 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-9942?

Yes, a patch is available for CVE-2026-9942. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9942

EUVD-2026-33084 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-05-28 Chrome

GHSA-56pj-6hm3-qpfx

Google Authentication Bypass Red Hat Suse Chrome

Medium

Disputed · 5.0 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

SUSE

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Red Hat

8.7 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:27 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

5.0 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 5.0

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Uninitialized memory use in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome versions prior to 148.0.7778.216 enables a remote attacker - who has already achieved renderer process compromise - to bypass site isolation via a specially crafted HTML page. This is a chained exploitation scenario: the vulnerability is not standalone, but serves as a second-stage primitive to break Chrome's cross-origin security boundary once an initial renderer foothold exists. No public exploit code has been identified at time of analysis, and the EPSS score of 0.01% (3rd percentile) reflects minimal observed exploitation activity.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is an open-source graphics translation library embedded in Google Chrome that converts OpenGL ES API calls to platform-native graphics APIs (DirectX, Vulkan, Metal, desktop OpenGL). CWE-457 (Use of Uninitialized Variable) describes a root-cause class where memory is read or used before it has been explicitly assigned a safe value, allowing the raw contents of previously allocated stack or heap memory to influence program behavior. In this context, the uninitialized state in ANGLE's graphics processing path can be manipulated by a renderer-level attacker to influence memory layout or logic in a way that defeats Chrome's site isolation architecture - the mechanism that places separate web origins into distinct renderer processes to contain cross-origin data leakage. The affected product scope per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop builds prior to the 148.0.7778.216 stable channel release.

RemediationAI

The primary fix is upgrading Google Chrome to version 148.0.7778.216 or later, which is the vendor-released patched version confirmed via the Chrome stable channel update advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's automatic update mechanism should apply this for most users; administrators managing enterprise fleets should verify rollout via group policy or MDM tooling. Because exploitation requires a pre-existing renderer compromise, organizations that cannot immediately patch should prioritize mitigations that reduce renderer exploit exposure: enabling Chrome's enhanced safe browsing mode (reduces delivery of malicious pages), enforcing strict site isolation via enterprise policy if not already default, and deploying endpoint detection capable of identifying anomalous renderer subprocess behavior. These compensating controls address the prerequisite stage of the chain rather than the ANGLE flaw itself, so patching remains the only definitive remediation.