PatchSiren cyber security CVE debrief
CVE-2026-9919 Google CVE debrief
CVE-2026-9919 is an out-of-bounds read vulnerability in WebGL affecting Google Chrome on Android versions prior to 148.0.7778.216. The vulnerability allows a remote attacker to leak cross-origin data through a crafted HTML page. Google has assigned this a High severity rating. The issue was published to the CVE database on May 28, 2026, with a subsequent modification on May 29, 2026. The vulnerability is categorized under CWE-125 (Out-of-bounds Read). No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- Vendor
- Product
- Chrome
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-29
Who should care
Organizations with mobile workforces using Android devices, developers of web applications relying on WebGL functionality, security teams monitoring browser-based attack vectors, and compliance officers tracking cross-origin data protection requirements.
Technical summary
This vulnerability exists in the WebGL implementation of Google Chrome on Android, where an out-of-bounds read condition can be triggered by malicious HTML content. Successful exploitation enables an attacker to read memory outside intended boundaries, specifically allowing leakage of data across origin boundaries. The attack vector requires user interaction with a crafted HTML page. The fix was released in Chrome 148.0.7778.216. The underlying weakness is classified as CWE-125 (Out-of-bounds Read), indicating improper restriction of read operations within the bounds of a memory buffer.
Defensive priority
high
Recommended defensive actions
- Update Google Chrome on Android to version 148.0.7778.216 or later to remediate this vulnerability.
- Monitor for unexpected cross-origin data access attempts in WebGL contexts as potential indicators of exploitation.
- Review application logs for anomalous WebGL activity from untrusted sources.
- Apply principle of least privilege for web content and consider additional isolation for sensitive data in browser contexts.
Evidence notes
The vulnerability description and affected product information are sourced from the official CVE record and NVD entry. The Chrome release notes and Chromium issue tracker provide additional technical context. Vendor identification is marked as low confidence due to reliance on reference domain inference; the affected vendor is Google based on the Chrome product reference.
Official resources
2026-05-28T23:16:49.990Z