PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9112 Google CVE debrief

CVE-2026-9112 is a high-severity use-after-free in Chrome’s GPU component on Windows. According to the CVE description, a remote attacker could trigger the flaw with a crafted HTML page and execute arbitrary code inside the browser sandbox on versions prior to 148.0.7778.179. NVD lists CWE-416 and a CVSS 3.1 score of 8.8, reflecting the potential impact of a successful browser compromise.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-20
Advisory published
2026-05-20
Advisory updated
2026-07-20

Who should care

Organizations running Google Chrome on Windows, especially endpoint teams, browser fleet managers, VDI administrators, and security teams responsible for patching internet-facing user workstations.

Technical summary

The reported issue is a use-after-free condition in the GPU path of Chrome on Windows. The CVE description says exploitation is possible through a crafted HTML page and can lead to arbitrary code execution inside the sandbox. NVD records the weakness as CWE-416 and the vector as AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which indicates remote delivery but requires user interaction through page rendering.

Defensive priority

High. This is a remotely reachable browser flaw with high CVSS impact and a user-interaction requirement, so it should be prioritized in managed desktop and browser update cycles.

Recommended defensive actions

  • Update Google Chrome on Windows to version 148.0.7778.179 or later.
  • Confirm fleet-wide browser version compliance, including managed and unmanaged endpoints where possible.
  • Prioritize patching for users with high web exposure or access to sensitive internal resources.
  • Review Chromium release notes and the linked issue for any additional vendor guidance.
  • Use standard browser hardening and least-privilege endpoint controls to limit the impact of a browser sandbox compromise.

Evidence notes

This debrief is based on the CVE description and NVD metadata supplied in the source corpus. The description states the issue affects Google Chrome on Windows prior to 148.0.7778.179 and involves a crafted HTML page. NVD metadata lists CWE-416, CVSS 3.1 8.8, and the official Chromium release blog and issue tracker as references. The vendor metadata in the corpus is low-confidence and marked for review, so this write-up avoids expanding beyond the explicitly supplied evidence.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9112 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9112

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9112 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9112

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.