What is the CVSS score of CVE-2026-9981?

CVE-2026-9981 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9981?

Yes, a patch is available for CVE-2026-9981. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9981

EUVD-2026-33123 MEDIUM

Information Exposure (CWE-200)

2026-05-28 Chrome

GHSA-w395-2q8g-22px

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:27 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

6.5 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 6.5

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Inappropriate implementation in the Skia graphics library within Google Chrome prior to 148.0.7778.216 enables remote attackers to read potentially sensitive data from renderer process memory by delivering a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms unauthenticated network exploitation with high confidentiality impact, constrained only by the requirement for user interaction. No public exploit has been identified at time of analysis, and EPSS at 0.03% (11th percentile) indicates minimal observed exploitation activity.

Technical ContextAI

Skia is Google's open-source 2D graphics rendering library, embedded in Chrome as the primary engine for drawing text, shapes, images, and composited layers. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that Skia's implementation incorrectly exposes memory contents that should not be accessible to web-origin contexts. The 'inappropriate implementation' framing used by the Chrome security team suggests a logic or bounds error in how Skia processes certain graphical operations triggered from HTML/CSS, rather than a classic memory corruption. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome platforms prior to the fixed release. Because Skia operates within Chrome's renderer process, leaked memory could include data from the current browsing session held in that process.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.216 or later, which contains the vendor-released patch as documented in the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprise environments managing Chrome via Chrome Browser Cloud Management, Google Admin Console, or group policy should push this update through standard patch management pipelines. As a compensating control prior to patching, organizations can enforce web proxy filtering to block access to unknown or untrusted external domains, which reduces exposure to attacker-crafted pages; however, this does not eliminate risk if the attacker can embed content in a trusted site or deliver the payload via advertising networks. No side effects of the patch have been disclosed by the vendor.