What is the CVSS score of CVE-2026-9972?

CVE-2026-9972 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9972?

Google Chrome on macOS (versions before 148.0.7778.216) contains a privilege-escalation flaw (CVE-2026-9972, CVSS 8.3) that allows attackers to escape browser sandbox containment if the renderer…. A patch is available.

How to fix or mitigate CVE-2026-9972?

24 hours: Inventory Chrome deployments on macOS and assess renderer isolation controls. 7 days: Deploy Chrome version 148.0.7778.216 or later via your standard patch management workflow. 30 days: Verify patch compliance across the macOS fleet and audit Chrome auto-update settings.

Google Chrome CVE-2026-9972

EUVD-2026-33114 HIGH

Use of Uninitialized Variable (CWE-457)

2026-05-28 Chrome

GHSA-p4c3-gfp9-4r8q

Google Information Disclosure Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:42 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Uninitialized Use in Gamepad in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page targeting the Gamepad component. The flaw is rated High by Chromium and carries a CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C), but EPSS is only 0.03% (11th percentile) and no public exploit identified at time of analysis. The bug is a second-stage primitive in a multi-stage exploit chain rather than a standalone RCE.

Technical ContextAI

The vulnerability is in Chrome's Gamepad subsystem, which exposes the W3C Gamepad API to web content via an IPC interface between the sandboxed renderer process and a more privileged browser-process component on macOS. CWE-457 (Use of Uninitialized Variable) indicates that a memory region - likely a struct, buffer, or pointer field handled in the Gamepad code path - is read before being assigned, yielding either stack/heap residue (potential info leak) or a controllable value that can be coerced into a type confusion or arbitrary read/write primitive across the renderer/browser trust boundary. The affected CPE is cpe:2.3:a:google:chrome and the issue is macOS-specific, suggesting the uninitialized state lives in platform-specific Gamepad backend code (likely the IOKit/HID bridge) rather than the cross-platform layer.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 for macOS - upgrade to this or a later stable-channel build via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. In managed-fleet environments, push the update through MDM (Jamf, Intune, Kandji) and force-relaunch Chrome to ensure the new binary is active, since the patch is dormant until restart. If patch deployment must be delayed, a targeted compensating control is to disable the Gamepad API via enterprise policy or by setting the chrome://flags/#enable-gamepad related runtime features off where supported, or by blocking the Permissions-Policy gamepad=() at an enterprise proxy that injects response headers; the trade-off is that any legitimate browser-based game, WebXR, or accessibility input use case will break. Network-level mitigation is not effective here because exploitation requires only a visit to attacker-controlled HTML, so URL filtering would have to be near-total to help.