PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9966 Google CVE debrief

An integer overflow vulnerability in Chrome's XML processing on Windows enables sandbox escape from a compromised renderer process. The attacker must first achieve renderer compromise (e.g., via separate vulnerability), then use a crafted HTML page to trigger the overflow and escape the sandbox. The CVSS 3.1 score of 8.3 reflects high impact (confidentiality, integrity, availability) with network attack vector but requiring user interaction and high attack complexity. Chrome versions prior to 148.0.7778.216 are affected. Google assigned Chromium security severity High. The NVD record lists CWE-472 (External Control of Assumed-Immutable Web Parameter) as a secondary weakness classification from the Chrome security team.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with Windows endpoints running Google Chrome, particularly those in high-threat environments where drive-by or chained browser exploitation is a concern. Security teams responsible for browser security, endpoint hardening, and sandbox escape prevention.

Technical summary

The vulnerability is an integer overflow in XML processing within Google Chrome on Windows. A remote attacker who has already compromised the renderer process can exploit this flaw using a crafted HTML page to potentially escape the Chrome sandbox. The attack requires network access, user interaction (e.g., visiting a malicious page), and high complexity due to the prerequisite renderer compromise. Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability with scope change (S:C). The fix is included in Chrome stable channel version 148.0.7778.216.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome on Windows to version 148.0.7778.216 or later.
  • Prioritize patching endpoints where users browse untrusted or attacker-controlled web content.
  • Ensure renderer compromise detection and response capabilities are operational, as this vulnerability requires prior renderer process compromise.
  • Review and restrict execution of untrusted HTML content in isolated or sandboxed environments where Chrome updates may be delayed.

Evidence notes

CVE description states 'Integer overflow in XML in Google Chrome on Windows prior to 148.0.7778.216' and 'sandbox escape via a crafted HTML page.' CPE configuration confirms versionEndExcluding 148.0.7778.216 for Google Chrome on Windows. CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H yields base score 8.3. NVD weakness entry lists CWE-472 from [email protected] as Secondary source.

Official resources

2026-05-28