PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9952 Google CVE debrief

A use-after-free vulnerability in Google Chrome's WebAudio component allows remote code execution inside the browser sandbox when a user visits a crafted HTML page. The flaw was fixed in Chrome 148.0.7778.216. Google rates this as High severity. The NVD-assigned CVSS 3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact to confidentiality, integrity, and availability. The underlying weakness is CWE-416 (Use After Free). No known exploitation in ransomware campaigns has been catalogued in CISA KEV.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with managed Chrome deployments, security operations centers monitoring browser-based threats, and endpoint protection teams responsible for patching cadences.

Technical summary

The vulnerability exists in Chrome's WebAudio implementation where a memory region is accessed after being freed. A remote attacker can trigger this condition through a malicious HTML page, leading to arbitrary code execution within the Chrome sandbox. Successful exploitation requires user interaction (e.g., visiting the crafted page). The sandbox containment limits but does not eliminate the security impact, as sandbox escapes may follow. The fix was released in Chrome stable channel update 148.0.7778.216.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.216 or later across all managed endpoints.
  • Verify automatic update mechanisms are enabled and functioning for Chrome installations.
  • If immediate patching is not feasible, consider restricting or blocking untrusted web content via browser policies, though this provides incomplete protection given the user-interaction requirement.
  • Monitor for anomalous browser crashes or unexpected renderer process behavior that may indicate exploitation attempts.
  • Review endpoint detection telemetry for signs of sandbox escape or secondary payload execution following browser compromise.

Evidence notes

CVE description states 'Use after free in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.' NVD CPE confirms affected product as Google Chrome with version end excluding 148.0.7778.216. CVSS vector from NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Weakness enumeration: CWE-416. Source references include Chrome Release Notes and Chromium issue tracker entry (permissions required).

Official resources

2026-05-28