PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9973 Google CVE debrief

An out-of-bounds write vulnerability in Google Chrome's V8 JavaScript engine, rated High severity by Chromium, enables remote code execution inside the browser sandbox when a user visits a crafted HTML page. The flaw was addressed in Chrome 148.0.7778.216 for desktop platforms.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with desktop Chrome deployments, particularly those with users who browse untrusted or adversarial web content. Security teams responsible for browser hardening, patch management, and endpoint detection should prioritize this update due to the High severity and remote attack vector.

Technical summary

CVE-2026-9973 is an out-of-bounds write in the V8 JavaScript engine used by Google Chrome. A remote attacker can exploit this vulnerability by convincing a user to load a maliciously crafted HTML page, resulting in arbitrary code execution within the Chrome sandbox. The vulnerability carries a CVSS 3.1 score of 8.8 (High) and is classified under CWE-787. Google resolved the issue in Chrome Stable version 148.0.7778.216, released in late May 2026. The underlying Chromium bug report remains access-restricted. No known exploitation in ransomware campaigns has been disclosed (KEV: false).

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.216 or later on all desktop endpoints (Windows, macOS, Linux).
  • Verify automatic update policies are enabled and functioning for managed Chrome deployments.
  • If immediate patching is not feasible, restrict user access to untrusted websites and enforce site isolation policies where available.
  • Monitor for unexpected Chrome crashes or renderer process terminations that may indicate exploitation attempts.
  • Review endpoint detection alerts for suspicious child processes spawned from Chrome renderer processes.

Evidence notes

CVE published 2026-05-28; NVD entry modified 2026-05-29. Vendor advisory confirms fix in Chrome Stable channel update. Chromium bug tracker entry is access-restricted. CPE data indicates affected product is Google Chrome versions prior to 148.0.7778.216 on Windows, macOS, and Linux. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CWE-787 (Out-of-bounds Write) assigned as secondary weakness.

Official resources

2026-05-28