PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9945 Google CVE debrief

A use-after-free vulnerability in Google Chrome's Media component on Windows allows remote code execution inside the sandbox when a user visits a crafted HTML page. The flaw was addressed in Chrome stable channel update 148.0.7778.216, published 2026-05-28. The Chromium security team rated this High severity. No known exploitation in ransomware campaigns has been catalogued in CISA KEV.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Windows users and administrators running Google Chrome; organizations with bring-your-own-device or unmanaged browser fleets where update velocity may lag. Enterprises relying on Chrome for productivity or secure browsing should treat this as a high-priority patch due to the RCE potential within the sandbox and the user-interaction attack vector that aligns with phishing and drive-by download scenarios.

Technical summary

The vulnerability exists in Chrome's Media component on Windows. A use-after-free condition can be triggered by a malicious HTML page, leading to arbitrary code execution within the sandboxed renderer process. The attack vector is network-based, requires low attack complexity, no privileges, and user interaction (visiting a page). The confidentiality, integrity, and availability impacts are all rated High. The fix was released in Chrome stable version 148.0.7778.216.

Defensive priority

high

Recommended defensive actions

  • Upgrade Google Chrome on Windows to version 148.0.7778.216 or later.
  • If automatic updates are enabled, verify the browser has restarted to apply the patch.
  • For managed environments, prioritize deployment using enterprise update channels and validate version compliance via endpoint management tools.
  • Restrict execution of untrusted HTML content and enforce site isolation policies where feasible as supplementary hardening.
  • Monitor for anomalous renderer or media-process crashes that may indicate exploitation attempts.

Evidence notes

CVE description and NVD metadata confirm the vulnerability class (CWE-416), affected product (Google Chrome on Windows), fixed version (148.0.7778.216), and Chromium severity rating (High). CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a base score of 8.8.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9945 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9945

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9945 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9945

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.