What is the CVSS score of EUVD-2026-31172?

EUVD-2026-31172 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-31172?

Yes, a patch is available for EUVD-2026-31172. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-31172

| CVE-2026-9122 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-20 Chrome

GHSA-m56p-rp6v-288r

Information Disclosure Google Buffer Overflow Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:34 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

6.5 (MEDIUM)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds read in the GPU process of Google Chrome on macOS prior to 148.0.7778.179 exposes potentially sensitive data from process memory to remote attackers. Exploitation requires a victim to visit a crafted HTML page (CVSS UI:R), limiting automation potential - consistent with SSVC's 'Automatable: no' determination. No public exploit identified at time of analysis and CISA has not added this to the Known Exploited Vulnerabilities catalog; Chrome's own severity rating is Medium.

Technical ContextAI

The vulnerability (CWE-125: Out-of-bounds Read) resides in Chrome's GPU process, a sandboxed component responsible for hardware-accelerated rendering operations including WebGL and canvas APIs. When processing a maliciously crafted HTML page, the GPU subsystem reads beyond the bounds of an allocated memory buffer, exposing data from the GPU process address space. On macOS, this process handles rendering state that may include sensitive content depending on browser activity. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with EUVD data confirming versions prior to 148.0.7778.179 are affected. The Mac-platform specificity is encoded in the CVE description rather than the CPE wildcards, so defenders should not rely on CPE alone for scoping.

RemediationAI

Upgrade Google Chrome on macOS to version 148.0.7778.179 or later, which contains the vendor-released patch per the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html. Enterprise administrators should enforce Chrome update policies via Google Admin Console or MDM solutions (e.g., Jamf, Kandji) to ensure timely deployment across Mac fleets. If immediate upgrade is not feasible, disabling hardware acceleration in Chrome (Settings → System → 'Use hardware acceleration when available') reduces GPU process attack surface at the cost of rendering performance and may cause visual degradation on complex pages. Blocking access to untrusted or unknown web content via proxy filtering can reduce exposure to crafted pages, though this does not eliminate risk from compromised legitimate sites.