What is the CVSS score of CVE-2026-9959?

CVE-2026-9959 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9959?

Yes, a patch is available for CVE-2026-9959. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9959

EUVD-2026-33101 LOW

Race Condition (CWE-362)

2026-05-28 Chrome

GHSA-fpq5-2g76-9w95

Information Disclosure Google Race Condition Microsoft

3.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from Vendor (Chrome) · only source for this CVE.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:29 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

3.1 (LOW)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's WebRTC component on Windows exposes limited confidential data to remote attackers via a race condition in all Chrome versions prior to 148.0.7778.216. An unauthenticated remote attacker (PR:N) can exploit this by luring a victim to a crafted HTML page, exploiting a timing window in WebRTC's concurrent execution to read cross-origin data. No public exploit has been identified at time of analysis and EPSS stands at 0.03% (9th percentile), indicating very low real-world exploitation pressure despite Chrome's internal 'High' severity classification.

Technical ContextAI

WebRTC (Web Real-Time Communication) is a built-in browser API enabling peer-to-peer audio, video, and data streaming directly within web pages. The root cause is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization), a race condition in Chrome's WebRTC implementation on Windows. The flaw arises in a timing-sensitive code path where a security boundary check and subsequent resource access are not atomically protected, allowing an attacker to read cross-origin data during the unsynchronized window between check and use. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to Windows covers all Chrome versions, with the ENISA EUVD identifier EUVD-2026-33101 corroborating the version range as all releases below 148.0.7778.216. The Chromium issue tracker entry (https://issues.chromium.org/issues/504557432) is the upstream bug report.

RemediationAI

The primary fix is to upgrade Google Chrome on Windows to version 148.0.7778.216 or later, as released in the stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome applies updates automatically for most consumer deployments; enterprise administrators using Chrome Browser Cloud Management or Group Policy should verify that the 148.0.7778.216 build has been fully rolled out across managed Windows endpoints. As a compensating control prior to patching, WebRTC can be disabled organization-wide via the Chrome enterprise policy 'WebRtcAllowed=false' - note this will break browser-based video conferencing (Google Meet, Teams Web, Zoom Web App) and all real-time peer-to-peer communication features, which is a significant operational trade-off. Alternatively, restricting end users from visiting untrusted external sites via web proxy categorization reduces exposure. Given the low CVSS score and near-zero EPSS, emergency out-of-band patching is not warranted for most organizations.