PatchSiren cyber security CVE debrief
CVE-2026-9897 Google CVE debrief
A use-after-free vulnerability in the DOM implementation of Google Chrome prior to version 148.0.7778.216 enables remote code execution within the browser sandbox. The flaw, assigned CWE-416 and rated High severity by Chromium, can be triggered by a crafted HTML page. Google addressed this issue in a stable channel update released May 28, 2026.
- Vendor
- Product
- Chrome
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-29
Who should care
Organizations with Chrome deployments, security teams managing browser attack surface, and incident responders investigating browser-based compromise vectors.
Technical summary
The vulnerability exists in Chrome's DOM implementation where a use-after-free condition permits memory corruption. An attacker can exploit this by delivering a malicious HTML page that manipulates DOM object lifecycles, resulting in arbitrary code execution within the renderer sandbox. The fix in Chrome 148.0.7778.216 resolves the underlying memory management flaw.
Defensive priority
high
Recommended defensive actions
- Upgrade Google Chrome to version 148.0.7778.216 or later immediately.
- Verify automatic update settings are enabled for Chrome installations across endpoints.
- Review browser-based threat detection logs for anomalous HTML document handling or renderer crashes prior to patching.
- Consider site isolation policies and sandbox hardening as compensating controls where immediate patching is delayed.
Evidence notes
Vulnerability description and affected version range sourced from NVD record and Chrome Release Blog. CWE-416 classification confirmed via NVD weaknesses field. Chromium severity rating of High per official description.
Official resources
2026-05-28