CVE-2026-9949

Description

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Overview

State

—

Assigner (CNA)

—

CVSS severity

MEDIUM

CVSS score

5.0 / 10

CVSS vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Effective score

5.0 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

2026-06-01 00:00 UTC

Last updated

2026-06-19 14:40 UTC

Source

https://www.rapid7.com/db/vulnerabilities/debian-cve-2026-9949/

Linked Threat

CVE-2026-9949 — CVE-2026-9949

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-05-28 23:16:53 UTC

NVD last modified

2026-07-21 11:10:00 UTC

NVD CVSS v3.1

8.3 / 10 HIGH source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

NVD CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability subscore

1.6 / 10

Impact subscore

6.0 / 10

EPSS score

0.0022 (probability of exploitation in next 30 days)

EPSS percentile

12.94% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD-assigned CWE(s): CWE-416 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-33091

Assigner

Chrome

Published

May 28, 2026, 10:25:34 PM

Updated

May 30, 2026, 3:56:21 AM

EUVD base score (CVSS 3.1)

8.3 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

EUVD-reported EPSS

0.2200

Vendors

Google

Products

Chrome (148.0.7778.216 <148.0.7778.216)

Aliases

GHSA-fvq4-f7h4-5849

ENISA description: Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-15 03:02 UTC (source: CVRF).

Release

2026-May

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (10)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• MSRC update guide: CVE-2026-9949 msrc
• None Available msrc
• https://www.first.org/epss/ tenable:www.first.org
• https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html tenable:chromereleases.googleblog.com
• https://nvd.nist.gov/vuln/detail/CVE-2026-9949 tenable:nvd.nist.gov
• https://issues.chromium.org/issues/503793153 rapid7:issues.chromium.org
• http://cwe.mitre.org/data/definitions/416.html rapid7:cwe.mitre.org
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33091 rapid7:euvd.enisa.europa.eu
• https://www.cve.org/CVERecord?id=CVE-2026-9949 rapid7:www.cve.org
• https://attackerkb.com/topics/CVE-2026-9949 rapid7:attackerkb.com

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Rapid7 — Solution
  rapid7

  google-chrome-upgrade-latest

  2026-06-04 08:59 UTC
• Rapid7 — Solution
  rapid7

  debian-upgrade-chromium

  2026-06-04 08:56 UTC
• Microsoft Patch Tuesday June 2026 - 198 Vulnerabilities Fixed ...
  web:cybersecuritynews.com

  Microsoft has released its June 2026 Patch Tuesday security updates, addressing a hefty 198 vulnerabilities across its product ecosystem. The June rollout, published on June 9, 2026 , stands out not only for its volume but also for the inclusion of three zero-day vulnerabilities that were actively exploited or publicly known before a fix was available. Administrators are urged to prioritize ...

  2026-06-19 02:30 UTC
• Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...
  web:cybersecuritynews.com

  Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

  2026-06-19 02:30 UTC
• Security Update Guide - Loading - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-06-19 02:30 UTC
• 2 New Microsoft Defender Zero-Days Exploited—Patch Now Rolling Out
  web:tech.yahoo.com

  Microsoft has now confirmed two new Microsoft Defender zero-days that it said had been exploited. This exploitation was confirmed by CISA, which has added the security flaws to its Known Exploited Vulnerabilities catalog and given federal agencies until June 3 to ensure mitigation measures are in place.

  2026-06-19 02:30 UTC
• CVE-2026-9949 - vulnerability database | Vulners.com
  web:vulners.com

  CVE-2026-9949 affects Google Chrome on Windows, caused by a use-after-free in the Core component that could allow a remote attacker who compromised the renderer process to escape the sandbox via a crafted HTML page. Affected versions are prior to ...

  2026-06-19 02:30 UTC
• May 2026 Patch Tuesday: Updates and Analysis | CrowdStrike
  web:www.crowdstrike.com

  Microsoft has released security updates for 130 vulnerabilities, including 30 critical, in its May 2026 Patch Tuesday rollout.

  2026-06-19 02:30 UTC
• Microsoft working on a fix for RoguePlanet, a flaw that grants full PC ...
  web:www.malwarebytes.com

  Microsoft says it's working on a fix for an unpatched Defender vulnerability that can give attackers the highest level of access on Windows.

  2026-06-19 02:30 UTC
• Microsoft Technical Security Notifications
  web:www.microsoft.com

  Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.

  2026-06-19 02:30 UTC
• Active Exploitation Alert: Google Chrome 149 Critical Vulnerabilities ...
  web:www.rescana.com

  The CISA Known Exploited Vulnerabilities (KEV) Catalog has listed CVE - 2026 -11645 as requiring immediate remediation , particularly for federal agencies, but the guidance extends to all organizations due to the widespread use of Chrome.

  2026-06-19 02:30 UTC
• Patch Tuesday June 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-06-19 02:30 UTC

Only Available for Registered Users. Sign in to view.