What is the CVSS score of EUVD-2026-31174?

EUVD-2026-31174 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-31174?

Yes, a patch is available for EUVD-2026-31174. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-31174

| CVE-2026-9124 MEDIUM

Improper Input Validation (CWE-20)

2026-05-20 Chrome

GHSA-xjvj-qvp3-h2cg

Information Disclosure Google

5.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.8 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:35 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

5.3 (MEDIUM)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome prior to 148.0.7778.179 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw stems from insufficient input validation (CWE-20) in Chrome's Input handling, enabling a crafted HTML page to exfiltrate data across origin boundaries. No active exploitation is confirmed - SSVC assigns exploitation status 'none' and the vulnerability is not listed in CISA KEV - but the confidentiality impact is rated High by CVSS, warranting prompt patching.

Technical ContextAI

The vulnerability resides in the Input component of Google Chrome's Blink rendering engine, classified under CWE-20 (Improper Input Validation). The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop versions prior to 148.0.7778.179. Chrome's multi-process architecture isolates web content in renderer processes sandboxed from the browser process; however, this flaw is exploitable only post-renderer-compromise, meaning it functions as a second-stage information disclosure primitive within an already-broken sandbox. The cross-origin data leak exploits Chrome's handling of untrusted input, bypassing the Same-Origin Policy (SOP) isolation guarantees that normally prevent one origin from reading another's data.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.179. Users and administrators should update Google Chrome to version 148.0.7778.179 or later via Chrome's built-in update mechanism (chrome://settings/help) or enterprise deployment tooling. The stable channel update is documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html. Since exploitation requires a pre-compromised renderer process, organizations running Chrome with site isolation enabled (the default) already partially constrain the blast radius; ensuring site isolation is not disabled via enterprise policy provides a meaningful compensating control for environments that cannot patch immediately. Restricting access to untrusted web content via URL filtering or managed browser profiles can reduce exposure to the crafted HTML page delivery vector while the patch is deployed.