PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9113 Google CVE debrief

CVE-2026-9113 is an out-of-bounds read in the GPU component of Google Chrome on macOS. According to the CVE description, a remote attacker could trigger the issue through a crafted HTML page in Chrome versions prior to 148.0.7778.179. The NVD record maps the issue to CWE-125 and shows a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating user interaction is required and the primary impact is limited confidentiality exposure. Google’s Chrome release notes and Chromium issue tracker are listed as source references in the NVD entry, which supports this as a browser patching issue rather than a general system vulnerability. The vendor’s Chromium severity is marked High in the supplied description, so even with a medium CVSS score, this should be treated as a prompt update item for managed Chrome on Mac fleets.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-05-21
Advisory published
2026-05-20
Advisory updated
2026-05-21

Who should care

Security teams, Mac endpoint administrators, managed browser operators, and users who run Google Chrome on macOS—especially environments that rely on rapid browser patching and allow access to untrusted web content.

Technical summary

The flaw is an out-of-bounds memory read in Chrome’s GPU path on macOS. A crafted HTML page can cause the browser to read memory outside the intended bounds, which can expose limited information but does not indicate integrity or availability impact in the supplied CVSS vector. The issue is identified as CWE-125 and fixed in Chrome 148.0.7778.179.

Defensive priority

High for Google Chrome on macOS fleets. Prioritize deployment of 148.0.7778.179 or later as soon as practical, since the issue is remotely triggerable through browser content and Google’s Chromium severity is listed as High.

Recommended defensive actions

  • Update Google Chrome on macOS to version 148.0.7778.179 or later.
  • Verify that auto-update or managed browser update policies are working and that the fixed build is actually installed.
  • Prioritize Mac endpoints that regularly browse untrusted or externally supplied web content.
  • Track the linked Chrome release note and Chromium issue for any follow-up guidance or related fixes.

Evidence notes

The supplied NVD record states vulnStatus "Received" and includes references to a Google Chrome Stable Channel update and a Chromium issue tracker entry. The CVE description specifies Google Chrome on Mac prior to 148.0.7778.179 and a crafted HTML page as the trigger. The NVD CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, and the listed weakness is CWE-125.

Official resources

CVE-2026-9113 was published by NVD on 2026-05-20, with references pointing to Google’s Chrome stable-channel update and the Chromium issue tracker entry. Use the CVE publication date and vendor references as the timing context for this item