PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9977 Google CVE debrief

A high-severity vulnerability in Google Chrome on Android's WebShare feature, where insufficient validation of untrusted input could allow a remote attacker who had compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The vulnerability was addressed in Chrome version 148.0.7778.216. The Chromium project rated this as High severity. The issue involves improper input validation (CWE-20) in the WebShare API implementation on Android, which could be leveraged after renderer compromise to achieve sandbox escape.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with Android device fleets using Google Chrome, mobile security teams, browser security researchers, and enterprises relying on Chrome for Android in BYOD or managed device environments.

Technical summary

The vulnerability exists in the WebShare implementation in Google Chrome on Android versions prior to 148.0.7778.216. Insufficient validation of untrusted input allows an attacker who has already achieved renderer process compromise to potentially escape the browser sandbox. The attack vector requires user interaction (UI:R) and high attack complexity (AC:H), but network exploitable (AV:N) with changed scope (S:C) leading to high impact on confidentiality, integrity, and availability. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H scoring 8.3. This is classified under CWE-20 (Improper Input Validation).

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome on Android to version 148.0.7778.216 or later as soon as possible
  • Monitor for Chrome Stable Channel security updates from Google
  • Apply mobile device management policies to enforce minimum Chrome version requirements
  • Review and restrict untrusted web content rendering where feasible on managed Android devices
  • Monitor for anomalous renderer process behavior that could indicate compromise attempts

Evidence notes

CVE published 2026-05-28; modified 2026-05-29. Chrome Stable Channel update released addressing this issue. Chromium bug tracker issue 511741173. CVSS 3.1 score: 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Official resources

2026-05-28