CVE-2026-9967
A memory corruption bug in Chrome’s GPU code lets a remote attacker escape the browser sandbox by loading a specially crafted web page. The flaw can be triggered without user interaction beyond visiting the page. It affects Chrome versions before 148.0.7778.216 on Windows, macOS, and Linux.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Google Chrome browsers older than version 148.0.7778.216 on Windows, macOS, and Linux.
Real-world impact
An attacker could run code outside the browser sandbox, potentially accessing the user’s system or data.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability is network‑based, requires no privileges, and can lead to full compromise of confidentiality, integrity, and availability. The vector shows it is exploitable over the network, with low effort, no user interaction beyond a malicious page, and a complete compromise if successful.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 28, 2026 · May 28, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/05/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/506414791permissions required