CVE-2026-9975: Out of bounds read and write in Google Chrome
CVE-2026-9975 is a high-severity vulnerability in Google Chrome prior to version 148.0.7778.216 involving out of bounds read and write errors in the ANGLE component. This flaw could allow a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox by using a specially crafted HTML page. The vulnerability affects confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported at this time. The vendor has published an advisory but has not explicitly confirmed the patch status in the provided data.
AI Analysis
Technical Summary
This vulnerability involves out of bounds read and write (CWE-125 and CWE-787) in the ANGLE graphics abstraction layer within Google Chrome versions prior to 148.0.7778.216. An attacker with control over the renderer process could exploit this flaw to perform a sandbox escape, potentially leading to full system compromise. The CVSS v3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and availability, with attack vector network, high attack complexity, no privileges required, user interaction required, and scope changed.
Potential Impact
Successful exploitation could allow a remote attacker to escape the Chrome sandbox from the renderer process, leading to potential full system compromise including unauthorized access to sensitive data, modification of system state, or denial of service. The vulnerability affects confidentiality, integrity, and availability at a high level.
Mitigation Recommendations
The vendor has published a stable channel update advisory for Chrome (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). However, the provided data does not explicitly confirm whether a patch is included or available. Users and administrators should consult the vendor advisory directly to verify patch availability and apply updates promptly if a fix is released. Until confirmed, assume patch status is not yet confirmed and monitor vendor communications for remediation guidance.
CVE-2026-9975: Out of bounds read and write in Google Chrome
Description
CVE-2026-9975 is a high-severity vulnerability in Google Chrome prior to version 148.0.7778.216 involving out of bounds read and write errors in the ANGLE component. This flaw could allow a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox by using a specially crafted HTML page. The vulnerability affects confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported at this time. The vendor has published an advisory but has not explicitly confirmed the patch status in the provided data.
CVSS v3.1
Score 8.3high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves out of bounds read and write (CWE-125 and CWE-787) in the ANGLE graphics abstraction layer within Google Chrome versions prior to 148.0.7778.216. An attacker with control over the renderer process could exploit this flaw to perform a sandbox escape, potentially leading to full system compromise. The CVSS v3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and availability, with attack vector network, high attack complexity, no privileges required, user interaction required, and scope changed.
Potential Impact
Successful exploitation could allow a remote attacker to escape the Chrome sandbox from the renderer process, leading to potential full system compromise including unauthorized access to sensitive data, modification of system state, or denial of service. The vulnerability affects confidentiality, integrity, and availability at a high level.
Mitigation Recommendations
The vendor has published a stable channel update advisory for Chrome (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). However, the provided data does not explicitly confirm whether a patch is included or available. Users and administrators should consult the vendor advisory directly to verify patch availability and apply updates promptly if a fix is released. Until confirmed, assume patch status is not yet confirmed and monitor vendor communications for remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-05-28T17:25:05.751Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html","vendor":"Google"}]
Threat ID: 6a18c67be29bf47b503b6443
Added to database: 05/28/2026, 22:49:31 UTC
Last enriched: 06/05/2026, 21:16:41 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.