CVE-2026-9959 is a race condition vulnerability in the WebRTC implementation of Google Chrome on Windows platforms before version 148.0.7778.216. The flaw enables a remote attacker to bypass same-origin data protections and leak cross-origin information by leveraging a crafted HTML page. The vulnerability was publicly disclosed and assigned a high severity rating by the Chromium security team. Although no CVSS score is provided, the vendor advisory confirms a stable update has been released to remediate the issue.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of cross-origin data, potentially exposing sensitive information from other web origins to a remote attacker. This compromises the confidentiality guarantees normally enforced by browser same-origin policies.

Google has released a stable channel update for Chrome version 148.0.7778.216 that addresses this vulnerability. Users and administrators should update affected Chrome installations to this version or later to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.