PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9959 Google CVE debrief

A race condition in WebRTC on Google Chrome for Windows, fixed in version 148.0.7778.216, could allow a remote attacker to leak cross-origin data by enticing a user to visit a crafted HTML page. The Chromium project rated this flaw as High severity, though the published CVSS 3.1 base score is 3.1 (Low). The weakness is categorized as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). The vulnerability was published in the NVD on 2026-05-28 and last modified on 2026-05-29. No known exploitation in ransomware campaigns has been documented, and this CVE is not listed in CISA KEV.

Vendor
Google
Product
Chrome
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations with Windows endpoints running Google Chrome, particularly those relying on WebRTC-based communications or handling sensitive cross-origin data in browser sessions.

Technical summary

The vulnerability stems from a race condition (CWE-362) in the WebRTC implementation of Google Chrome running on Windows. A remote attacker could exploit this by convincing a user to load a malicious HTML page, resulting in leakage of cross-origin data. The issue was resolved in Chrome 148.0.7778.216. The attack requires network access, high attack complexity, no privileges, and user interaction, with a low impact to confidentiality and no impact to integrity or availability per the CVSS vector.

Defensive priority

medium

Recommended defensive actions

  • Update Google Chrome on Windows to version 148.0.7778.216 or later.
  • If immediate patching is not feasible, consider restricting or disabling WebRTC through enterprise policies or browser settings where business needs permit, understanding this may impact legitimate video conferencing and
  • real-time communication applications.
  • Apply standard web security controls such as content security policies and careful origin isolation to reduce exposure to cross-origin data leak vectors.

Evidence notes

The vulnerability description and affected product scope are drawn from the official NVD record and Chrome release notes. The CPE configuration indicates Chrome versions prior to 148.0.7778.216 on Windows are affected. The Chromium issue tracker reference is marked as requiring permissions to view full details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9959 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9959

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9959 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9959

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.