PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9116 Google CVE debrief

CVE-2026-9116 affects Google Chrome prior to 148.0.7778.179. According to the CVE description, insufficient policy enforcement in ServiceWorker could allow a remote attacker to leak cross-origin data from a crafted HTML page. NVD lists the issue as CVSS 4.3 (Medium), while Chromium labels it High severity, so it is worth prioritizing browser updates even though user interaction is required.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-20
Advisory published
2026-05-20
Advisory updated
2026-07-20

Who should care

Chrome/Chromium browser administrators, enterprise endpoint teams, and users running versions earlier than 148.0.7778.179—especially where browser-based access to sensitive internal or cross-origin web content matters.

Technical summary

The vulnerability is described as an insufficient policy enforcement issue in ServiceWorker. The attacker model in NVD is network-based with low attack complexity and no privileges, but it requires user interaction (CVSS: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The impact is confidentiality-only: a crafted HTML page could leak cross-origin data. The NVD record also associates the issue with CWE-693 (Protection Mechanism Failure).

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to 148.0.7778.179 or later on all affected systems.
  • Verify the browser version across managed endpoints and enforce update compliance.
  • Restart browsers after updating so the fixed code is actually loaded.
  • Prioritize systems that routinely access sensitive internal applications or multiple web origins in the same browser profile.

Evidence notes

The CVE description explicitly states the affected product, the fixed version boundary, the ServiceWorker policy enforcement weakness, the crafted HTML trigger, and the cross-origin data leak outcome. The NVD record provides the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), severity score 4.3, and CWE-693. The supplied references point to the Chrome Stable Channel update page and a Chromium issue tracker entry, but the bulletin text itself was not included in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9116 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9116

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9116 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9116

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.