PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9911 Google CVE debrief

Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations and individuals using Google Chrome versions prior to 148.0.7778.216; security teams responsible for browser security posture; developers of web applications that may interact with WebGL or canvas rendering contexts.

Technical summary

CVE-2026-9911 is an integer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics translation layer used by Google Chrome. The flaw exists in Chrome versions prior to 148.0.7778.216. A remote attacker can exploit this vulnerability by convincing a user to visit a crafted HTML page, triggering an out-of-bounds memory read. The vulnerability is rated High severity by Chromium security standards. ANGLE translates OpenGL ES API calls to native graphics APIs (Direct3D, Metal, Vulkan), making this a graphics pipeline vulnerability that could potentially expose memory contents to attacker-controlled web content.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.216 or later.
  • Review and restrict execution of untrusted HTML content in browser environments.
  • Monitor for unexpected browser crashes or memory-related anomalies that may indicate exploitation attempts.
  • Apply principle of least privilege for browser processes where feasible.

Evidence notes

CVE published 2026-05-28; modified 2026-05-29. Vendor identified as Google (Chrome) via Chrome Releases blog reference. Affects Chrome versions prior to 148.0.7778.216. CWE-472 (External Control of Assumed-Immutable Web Parameter) listed in source metadata, though integer overflow typically maps to CWE-190; using source-provided classification. No KEV listing. No known ransomware campaign use documented.

Official resources

2026-05-28