PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9952 Google CVE debrief

A use-after-free vulnerability in Google Chrome's WebAudio component allows remote code execution inside the browser sandbox when a user visits a crafted HTML page. The flaw was fixed in Chrome 148.0.7778.216. Google rates this as High severity. The NVD-assigned CVSS 3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact to confidentiality, integrity, and availability. The underlying weakness is CWE-416 (Use After Free). No known exploitation in ransomware campaigns has been catalogued in CISA KEV.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations with managed Chrome deployments, security operations centers monitoring browser-based threats, and endpoint protection teams responsible for patching cadences.

Technical summary

The vulnerability exists in Chrome's WebAudio implementation where a memory region is accessed after being freed. A remote attacker can trigger this condition through a malicious HTML page, leading to arbitrary code execution within the Chrome sandbox. Successful exploitation requires user interaction (e.g., visiting the crafted page). The sandbox containment limits but does not eliminate the security impact, as sandbox escapes may follow. The fix was released in Chrome stable channel update 148.0.7778.216.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.216 or later across all managed endpoints.
  • Verify automatic update mechanisms are enabled and functioning for Chrome installations.
  • If immediate patching is not feasible, consider restricting or blocking untrusted web content via browser policies, though this provides incomplete protection given the user-interaction requirement.
  • Monitor for anomalous browser crashes or unexpected renderer process behavior that may indicate exploitation attempts.
  • Review endpoint detection telemetry for signs of sandbox escape or secondary payload execution following browser compromise.

Evidence notes

CVE description states 'Use after free in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.' NVD CPE confirms affected product as Google Chrome with version end excluding 148.0.7778.216. CVSS vector from NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Weakness enumeration: CWE-416. Source references include Chrome Release Notes and Chromium issue tracker entry (permissions required).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9952 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9952

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9952 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9952

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.