What is the CVSS score of EUVD-2026-31166?

EUVD-2026-31166 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-31166?

Yes, a patch is available for EUVD-2026-31166. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-31166

| CVE-2026-9116 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-05-20 Chrome

GHSA-m8xp-vjq7-78wm

Information Disclosure Google Suse Red Hat Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:34 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.3 (MEDIUM)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

ServiceWorker policy enforcement failure in Google Chrome prior to version 148.0.7778.179 enables unauthenticated remote attackers to leak cross-origin data by luring a victim to a crafted HTML page. The vulnerability stems from Chrome's ServiceWorker layer failing to adequately enforce isolation boundaries (CWE-693), allowing a malicious origin to read data it should not have access to under the same-origin policy. No public exploit identified at time of analysis, and the CVSS score of 4.3 reflects limited confidentiality impact; however, the zero-privilege, network-accessible attack vector means any Chrome user browsing a malicious page could be affected.

Technical ContextAI

ServiceWorkers are background JavaScript workers registered by web pages to intercept and manage network requests, enabling offline functionality, push notifications, and caching. They operate under strict same-origin policy constraints enforced by the browser to prevent cross-origin data access. CWE-693 (Protection Mechanism Failure) identifies the root cause: Chrome's policy enforcement within the ServiceWorker subsystem was insufficient, allowing a cross-origin data leak - meaning a ServiceWorker on an attacker-controlled origin could access or infer response content from a different origin that the attacker should not be able to read. The affected component is the Google Chrome browser application across all desktop platforms, as indicated by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with all versions prior to 148.0.7778.179 confirmed vulnerable per EUVD-2026-31166.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.179 or later, which is the vendor-confirmed patched release per the stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html. For most end users, Chrome's built-in auto-update will apply this fix automatically; users can manually trigger an update via chrome://settings/help. Enterprise administrators managing Chrome via Chrome Browser Cloud Management or Group Policy should verify that the minimum version policy is set to 148.0.7778.179 or higher and confirm fleet compliance before closing remediation. If patching is delayed in managed environments, a compensating control is to restrict ServiceWorker registration via enterprise policy (e.g., setting DefaultJavaScriptSetting or enforcing URL allowlists for service worker registration), though disabling JavaScript broadly will break significant web functionality. Blocking access to untrusted external sites at the network level can reduce the social engineering surface while the patch is deployed.