What is the CVSS score of CVE-2026-9989?

CVE-2026-9989 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9989?

Yes, a patch is available for CVE-2026-9989. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9989

EUVD-2026-33131 MEDIUM

Origin Validation Error (CWE-346)

2026-05-28 Chrome

GHSA-8g45-3jxc-cv2v

Authentication Bypass Google

6.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

SUSE

MEDIUM

qualitative

Red Hat

9.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:27 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

6.3 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 6.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to bypass same origin policy via a crafted video file. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's Media component allows remote attackers to read or manipulate cross-origin data via a crafted video file. Affected are all Chrome versions prior to 148.0.7778.216 on desktop platforms, confirmed via ENISA EUVD-2026-33131 and the Chrome stable channel advisory. The CVSS vector (PR:N/UI:R) indicates no authentication is required but victim interaction is necessary; EPSS sits at 0.02% (4th percentile), and no active exploitation is confirmed in the CISA KEV catalog, making this a medium-priority issue despite the network-accessible attack vector.

Technical ContextAI

The affected component is Chrome's Media subsystem, which processes and renders video content. CWE-346 (Origin Validation Error) identifies the root cause: the implementation fails to properly enforce same-origin policy boundaries when handling certain crafted video file inputs, allowing media-initiated operations to cross origin boundaries that the browser security model is designed to enforce. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms this affects the Google Chrome application across all platforms and architectures prior to the patched version. Same-origin policy is a foundational browser security primitive; its bypass can expose session tokens, authentication state, or DOM content from other origins depending on how the vulnerability is chained with other browser features.

RemediationAI

The vendor-released patch is Google Chrome 148.0.7778.216; users should update immediately via Chrome's built-in updater or by visiting the Chrome release advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For enterprise environments using managed Chrome deployments, push the update via policy as soon as the build is validated. No documented workaround eliminates the Media-component bypass, but organizations can reduce exposure by enforcing Content Security Policy (CSP) headers with strict media-src directives on sensitive web applications to limit the origins from which media content can be loaded, reducing the attacker's ability to deliver the crafted video in a useful context. Note that CSP is a mitigating control at the application layer, not a browser-level fix, and does not protect users browsing arbitrary attacker-controlled sites.