What is the CVSS score of CVE-2026-9991?

CVE-2026-9991 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9991?

Yes, a patch is available for CVE-2026-9991. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9991

EUVD-2026-33133 LOW

Information Exposure (CWE-200)

2026-05-28 Chrome

GHSA-7v93-h8jv-7vp7

Google Microsoft Information Disclosure Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:30 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

3.1 (LOW)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 148.0.7778.216) permits exfiltration of sensitive origin-isolated content, but only as a second-stage primitive requiring prior renderer process compromise. The confidentiality impact is constrained (CVSS 3.1/Low, CWE-200), with no integrity or availability consequences. No public exploit code exists and the EPSS score of 0.03% (11th percentile) reflects negligible real-world exploitation probability at time of analysis.

Technical ContextAI

The flaw resides in Chrome's Media subsystem on Windows - categorized as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - where an inappropriate implementation allows origin-isolation boundaries to be bypassed, enabling cross-origin data to be read or inferred from a crafted HTML page. The 'Microsoft' tag alongside Windows-platform specificity suggests the issue may involve Windows-native media APIs such as Windows Media Foundation or DirectShow pipelines, where Chrome's renderer does not sufficiently enforce origin segregation. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all pre-148.0.7778.216 Chrome builds on Windows are within scope. This sits within Chrome's multi-process architecture: the Media component in a compromised renderer can reach across origins in a way the browser's sandbox model should prohibit, making this a data exfiltration aid within a larger exploit chain rather than a standalone renderer exploit.

RemediationAI

Upgrade Google Chrome on Windows to stable channel version 148.0.7778.216 or later, as documented in the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's auto-update mechanism handles this in most consumer and managed enterprise environments; administrators should audit managed fleet versions to confirm the update has propagated. As a structural defense that limits the blast radius of any renderer compromise (including this flaw), verify that Chrome's Site Isolation (--site-per-process) is active - it is enabled by default in modern Chrome but can be disabled via enterprise policy, and disabling it would increase exposure. No workarounds short of upgrading have been identified for this specific flaw. Given the low CVSS score and absence of active exploitation, this can be addressed within a standard patch management cadence rather than requiring emergency out-of-band deployment.