PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9947 Google CVE debrief

A use-after-free vulnerability in Chrome's XML processing allows remote code execution inside the sandbox when a user visits a crafted HTML page. Google rated this High severity and patched it in Chrome 148.0.7778.216. The NVD entry was published on 2026-05-28 and last modified on 2026-05-29. No known exploitation in ransomware campaigns has been catalogued in CISA KEV.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with Chrome deployments, endpoint security teams, and users relying on Chrome for web browsing should prioritize this update due to the High severity and potential for remote code execution.

Technical summary

The flaw exists in Chrome's XML parser where a use-after-free condition can be triggered by malicious HTML content. Successful exploitation yields arbitrary code execution within the Chrome sandbox. The attack requires user interaction (visiting a crafted page) and has network attack vector with low complexity. The fix is contained in Chrome 148.0.7778.216.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.216 or later on all supported platforms (Windows, macOS, Linux).
  • Verify automatic update mechanisms are enabled for Chrome in managed environments.
  • If immediate patching is not feasible, restrict users from visiting untrusted websites and disable JavaScript where operationally acceptable, noting this may not fully eliminate attack surface.
  • Monitor for anomalous renderer process crashes or unexpected sandbox escape attempts as potential indicators of exploitation.
  • Review Chrome release notes for any additional follow-up fixes or stability updates related to this version.

Evidence notes

The vulnerability is catalogued as CWE-416 (Use After Free). CPE data indicates affected products are Google Chrome versions prior to 148.0.7778.216 on Windows, macOS, and Linux. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yielding a base score of 8.8 (High).

Official resources

Google disclosed this issue via the Chrome Release Notes on 2026-05-28. The underlying Chromium bug tracker entry is restricted (Permissions Required).