PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9933 Google CVE debrief

Use-after-free in Chrome Input handling enables remote heap corruption via crafted HTML and specific UI gestures. Google rated High severity. No known exploitation in the wild (not in CISA KEV). Patch available in Chrome 148.0.7778.216.

Vendor
Google
Product
Chrome
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations with unmanaged or broadly deployed Chrome installations; security teams tracking browser-based initial-access vectors; desktop support teams responsible for patch cadence.

Technical summary

CVE-2026-9933 is a use-after-free vulnerability in the Input component of Google Chrome. A remote attacker can craft a malicious HTML page and induce a victim to perform specific UI gestures, potentially triggering heap corruption. Successful exploitation could lead to arbitrary code execution within the Chrome sandbox. The flaw is fixed in Chrome 148.0.7778.216. The CVSS v3.1 score is 7.5 (High), with attack complexity rated High and user interaction required.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.216 or later on all endpoints.
  • If immediate patching is not feasible, restrict users from visiting untrusted websites and disable JavaScript where operationally acceptable, noting that this may not fully eliminate risk given the UI-gesture requirement
  • Monitor for unexpected Chrome crashes or memory-corruption indicators that could signal exploitation attempts
  • Review endpoint detection and response (EDR) telemetry for suspicious child processes spawned from Chrome after user interaction with untrusted HTML content

Evidence notes

CWE-416 (Use After Free) assigned by Google. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.5. Affected versions confirmed below 148.0.7778.216 per NVD CPE data. Vendor advisory and Chromium bug tracker both list Google as source.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9933 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9933

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9933 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9933

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.