What is the CVSS score of CVE-2026-9979?

CVE-2026-9979 has a contested CVSS base score of 5.0 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-9979?

Yes, a patch is available for CVE-2026-9979. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9979

EUVD-2026-33121 MEDIUM

Improper Input Validation (CWE-20)

2026-05-28 Chrome

GHSA-g56q-j2p4-7p5f

Google Authentication Bypass Chrome

Medium

Disputed · 5.0 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

SUSE

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Red Hat

7.9 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:26 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

5.0 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 5.0

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site isolation bypass in Google Chrome prior to 148.0.7778.216 enables a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page. The attack is constrained by a two-stage prerequisite: an existing renderer compromise plus user interaction with the malicious page, reflected in a CVSS score of 5.0 (AC:H/UI:R). No public exploit identified at time of analysis and an EPSS of 0.02% (6th percentile) indicate very low probability of widespread exploitation, though the technique is meaningful as a post-exploitation escalation primitive.

Technical ContextAI

Chrome's site isolation architecture enforces that each origin runs in a separate renderer process, preventing cross-origin data access. CWE-20 (Improper Input Validation) in Chrome's Input subsystem means that crafted input from a compromised renderer is not properly validated before being processed in a way that can violate isolation boundaries. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions across all platforms prior to the patched release 148.0.7778.216. The flaw is specifically in how renderer-supplied input is handled - the browser trusts data from a renderer that has already been subverted, allowing the attacker to manipulate cross-process communication to break isolation invariants.

RemediationAI

Update Google Chrome to version 148.0.7778.216 or later as detailed in the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome auto-updates by default on consumer installations; enterprise administrators should verify deployment via Google Admin or endpoint management tooling. As a compensating control while patches are staged, disabling or auditing third-party Chrome extensions reduces the renderer attack surface that this vulnerability depends on as a prerequisite - a compromised extension is a plausible renderer compromise vector. Strict site isolation (--site-per-process) is already the default in modern Chrome and should not be disabled. Blocking untrusted or unknown URLs at the network perimeter reduces the likelihood of users being directed to crafted pages, though this does not address the root renderer pre-compromise requirement.