PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9965 Google CVE debrief

CVE-2026-9965 is a high-severity out-of-bounds write vulnerability in ANGLE, the graphics layer used by Google Chrome. The flaw exists in Chrome versions prior to 148.0.7778.216 and can be triggered by a remote attacker through a crafted HTML page, potentially leading to heap corruption. The vulnerability was published in the NVD on May 28, 2026, and modified on May 29, 2026. Google has assigned this a Chromium security severity of High. The CVSS v3.1 score of 8.8 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and high impact to confidentiality, integrity, and availability. The underlying weakness is CWE-787 (Out-of-bounds Write). No known exploitation in ransomware campaigns has been documented, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with Google Chrome deployments, particularly those with users who browse untrusted or adversarial web content. Security teams responsible for browser security, patch management, and endpoint protection. Developers and security researchers tracking Chromium/ANGLE graphics subsystem vulnerabilities.

Technical summary

The vulnerability is an out-of-bounds write (CWE-787) in ANGLE (Almost Native Graphics Layer Engine), which Chrome uses to translate OpenGL ES API calls to native graphics APIs (Direct3D, Vulkan, Metal, etc.). A crafted HTML page can trigger this memory corruption condition. Successful exploitation could lead to heap corruption with potential for arbitrary code execution within the renderer process sandbox. The attack requires user interaction (e.g., visiting a malicious page) but no privileges or local access. The fix was released in Chrome 148.0.7778.216.

Defensive priority

high

Recommended defensive actions

  • Upgrade Google Chrome to version 148.0.7778.216 or later across all affected platforms (Windows, macOS, Linux).
  • Verify automatic update settings are enabled for Chrome in enterprise environments; if updates are managed, expedite deployment of the patched version.
  • Block or restrict untrusted web content and enforce site isolation policies as compensating controls where immediate patching is not feasible.
  • Monitor for anomalous browser crashes or renderer process terminations that may indicate exploitation attempts.
  • Review application logs for unexpected HTML/graphics rendering errors from untrusted sources.

Evidence notes

Vulnerability description and CPE data sourced from NVD official record. Chrome release notes confirm fix in version 148.0.7778.216. Chromium issue tracker reference exists but requires permissions to view full details. CVSS vector and CWE-787 classification provided by [email protected].

Official resources

Google Chrome Stable Channel update released May 2026