What is the CVSS score of CVE-2026-9980?

CVE-2026-9980 has a contested CVSS base score of 5.0 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-9980?

Yes, a patch is available for CVE-2026-9980. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9980

EUVD-2026-33122 MEDIUM

Improper Input Validation (CWE-20)

2026-05-28 Chrome

GHSA-6pj9-cg4h-v8ww

Google Authentication Bypass Chrome

Medium

Disputed · 5.0 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

SUSE

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Red Hat

6.7 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:26 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

5.0 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 5.0

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Printing in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site isolation bypass in Google Chrome's Printing component (versions prior to 148.0.7778.216) enables an attacker who has already compromised the renderer process to escape cross-origin data boundaries via a crafted HTML page. The root cause is insufficient input validation (CWE-20) in the printing subsystem, which fails to properly sanitize renderer-supplied data before acting on it in a security-sensitive context. With an EPSS of 0.02% (6th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this functions primarily as a post-exploitation escalation primitive rather than an initial access vector.

Technical ContextAI

Google Chrome's site isolation architecture enforces same-origin policy at the process level, placing content from distinct origins in separate renderer processes to prevent cross-site data leakage. CWE-20 (Improper Input Validation) in the Printing component means that when a renderer process supplies input to the printing subsystem, Chrome does not adequately validate or sanitize that input before processing it in a privileged context. This breakdown allows a compromised renderer - which is already operating outside its intended trust boundary - to pass malformed or adversarial data through the printing interface and influence cross-origin state. The affected software is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to 148.0.7778.216. The Chromium security severity is rated High, reflecting the architectural significance of a site isolation bypass even under constrained conditions.

RemediationAI

The primary fix is to update Google Chrome to version 148.0.7778.216 or later; this patch is confirmed available via the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's built-in auto-update mechanism will deliver this version automatically in most enterprise and consumer deployments; administrators should verify rollout completion via fleet management tooling. Because exploitation requires a prior renderer compromise, organizations that enforce Chrome's built-in renderer sandbox hardening (--enable-features=StrictSiteIsolation is default on desktop) and keep Chrome current reduce the attack surface for chained exploits of this type. Disabling or restricting print functionality via enterprise policy (PrintingEnabled=false) would eliminate this specific vector as a compensating control where printing is non-essential, though this carries obvious operational trade-offs. No workaround fully substitutes for patching.