PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9889 Google CVE debrief

A critical-severity out-of-bounds read and write vulnerability in Dawn (WebGPU implementation) in Google Chrome on Android prior to version 148.0.7778.216. The flaw allows a remote attacker to potentially escape the browser sandbox via a crafted HTML page. The vulnerability was published in the NVD on 2026-05-28 and modified on 2026-05-29. Chrome's stable channel update addresses this issue. No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's KEV catalog.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with Android device fleets, mobile security teams, BYOD programs, and users who rely on Chrome for sensitive web browsing on Android devices

Technical summary

CVE-2026-9889 is an out-of-bounds memory access vulnerability in Dawn, Chromium's WebGPU implementation, affecting Google Chrome on Android. The vulnerability involves both out-of-bounds read and write operations that can be triggered by a malicious HTML page. Successful exploitation could allow an attacker to break out of Chrome's sandbox protections, representing a critical security boundary violation. The vulnerability was remediated in Chrome stable channel version 148.0.7778.216. The underlying issue is tracked in the Chromium bug tracker and was addressed as part of a security update. Given the sandbox escape potential and remote attack vector via web content, this vulnerability poses significant risk to unpatched Android Chrome installations.

Defensive priority

critical

Recommended defensive actions

  • Update Google Chrome on Android devices to version 148.0.7778.216 or later immediately
  • Prioritize patching for devices accessing untrusted web content or with users in high-risk threat models
  • Monitor for additional Chrome security updates as the NVD entry status is 'Awaiting Analysis'
  • Review application logs for anomalous browser crashes or GPU process terminations that may indicate exploitation attempts
  • Consider enabling site isolation and enhanced safe browsing as defense-in-depth measures pending full patch deployment

Evidence notes

Vulnerability description and severity rating sourced from NVD record and Chrome release notes. Vendor attribution to Google based on Chrome release blog reference. Dawn is the WebGPU implementation in Chromium.

Official resources

2026-05-28