What is the CVSS score of CVE-2026-9953?

CVE-2026-9953 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9953?

Yes, a patch is available for CVE-2026-9953. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9953

EUVD-2026-33095 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-76w2-25ph-2mm6

Google Information Disclosure Buffer Overflow Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:28 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 6.5

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read in Chrome's ANGLE graphics layer exposes process memory to remote attackers who can deliver a crafted HTML page to a victim. Unauthenticated (PR:N) remote exploitation is confirmed by the CVSS vector, though user interaction is required - the victim must open a malicious page. Confidentiality impact is rated High (C:H) with no integrity or availability consequence, making this a targeted information-disclosure primitive rather than a code-execution path. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.03% (11th percentile) reflects low observed exploitation pressure.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the cross-platform graphics abstraction library embedded in Google Chrome that translates OpenGL ES calls to platform-native APIs such as DirectX on Windows, Metal on macOS, and Vulkan on Linux. A CWE-125 out-of-bounds read in ANGLE means the renderer process reads beyond the allocated boundary of a graphics buffer, leaking adjacent memory contents. Because Chrome's renderer operates under sandbox isolation, leaked data is constrained to renderer process memory - which may nonetheless contain sensitive page content, credentials, or session tokens from the active browsing context. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop variants prior to version 148.0.7778.216, as confirmed by EUVD-2026-33095.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216. Update Chrome to version 148.0.7778.216 or later using the browser's built-in update mechanism (Settings → Help → About Google Chrome) or via enterprise deployment tools. The fix is documented in the Chrome stable channel release at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the upstream Chromium issue tracker at issues.chromium.org/issues/503985322. If immediate patching is not feasible in managed enterprise environments, restricting navigation to untrusted or external HTML content via browser policy (URL filtering, Safe Browsing enforcement) reduces attack surface, though it does not eliminate the underlying flaw. There are no documented configuration flags to disable the ANGLE graphics layer in production Chrome builds without breaking rendering functionality.