PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9949 Google CVE debrief

A use-after-free vulnerability in Google Chrome's Core component on Windows allows a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox. The vulnerability is rated High severity by Chromium and carries a CVSS 3.1 score of 8.3. The flaw exists in Chrome versions prior to 148.0.7778.216 on Windows platforms. Successful exploitation requires user interaction (rendering a crafted HTML page) and prior compromise of the renderer process, but could result in a full sandbox escape with significant impact to confidentiality, integrity, and availability. Google has addressed this in the stable channel update; no known exploitation in the wild has been confirmed at time of publication.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with Windows endpoints running Google Chrome, particularly those with users who access external or untrusted web content. Security teams managing browser security and sandbox integrity should prioritize this update.

Technical summary

The vulnerability is a use-after-free (CWE-416) in Chrome's Core component affecting Windows builds. An attacker with control of the renderer process can trigger the flaw through a crafted HTML page to achieve sandbox escape. The attack complexity is high (AC:H) and requires user interaction (UI:R), but successful exploitation yields scope change (S:C) and high impact across all CIA triad elements. The fix was released in Chrome stable channel version 148.0.7778.216.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome on Windows to version 148.0.7778.216 or later as provided in the stable channel release.
  • Prioritize patching on endpoints where users browse untrusted or attacker-controlled web content, given the sandbox escape potential.
  • Monitor for signs of renderer process compromise as a potential precursor to exploitation of this vulnerability.
  • Review Chrome update deployment coverage across Windows endpoints to ensure comprehensive protection.

Evidence notes

CVE published 2026-05-28; NVD entry modified 2026-05-29 with Analyzed status. CPE confirms affected product as Google Chrome on Windows, with vulnerable versions prior to 148.0.7778.216. CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H supports score of 8.3. Weakness classified as CWE-416 (Use After Free). No KEV listing present.

Official resources

public