What is the CVSS score of CVE-2026-9996?

CVE-2026-9996 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9996?

Yes, a patch is available for CVE-2026-9996. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9996

EUVD-2026-33138 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-2vm7-4348-jv9f

Buffer Overflow Information Disclosure Google

6.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:30 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 6.5

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read in the WebRTC subsystem of Google Chrome on macOS (versions prior to 148.0.7778.216) enables remote attackers to exfiltrate potentially sensitive data from browser process memory by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N) confirms network-reachable, unauthenticated exploitation with confidentiality-only impact, but mandates user interaction, limiting fully passive attack scenarios. No active exploitation has been confirmed in CISA KEV, and an EPSS score of 0.03% at the 10th percentile reflects low observed exploitation probability at time of analysis; no public exploit code has been identified.

Technical ContextAI

The vulnerability resides in WebRTC (Web Real-Time Communication), the browser subsystem handling audio/video streaming, peer-to-peer data channels, and real-time media negotiation natively within Chrome. CWE-125 (Out-of-bounds Read) identifies the root cause: a memory read operation that accesses data beyond the boundary of its allocated buffer. In WebRTC's complex media processing pipeline - which involves parsing SDP session descriptors, RTP/RTCP packets, and codec-specific payloads - such flaws typically arise when attacker-controlled input causes a length or index miscalculation, permitting reads into adjacent memory regions. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome application versions; the Mac-specific constraint per the CVE description suggests the vulnerable code path or memory layout difference is isolated to Chrome's macOS build, potentially in a platform-specific WebRTC codec or IPC layer.

RemediationAI

Upgrade Google Chrome on macOS to version 148.0.7778.216 or later, which contains the vendor-released patch as documented in the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's built-in auto-update mechanism will deliver this version upon browser restart; administrators and users should verify the installed version by navigating to chrome://settings/help and confirming 148.0.7778.216 or higher. If immediate patching is not feasible in managed environments, restricting user navigation to untrusted or unvetted HTML content via web proxy filtering or Safe Browsing enforcement reduces exposure. Disabling WebRTC entirely via Chrome enterprise policy (setting WebRtcAllowed to false) would eliminate the attack surface at the cost of breaking all WebRTC-dependent functionality including video conferencing, screen sharing, and peer-to-peer data transfer - this is a significant operational trade-off and is recommended only as a temporary measure while patching is coordinated.