Cyber Resilience

CVE-2026-9889

HighUpdated

Published: 28 May 2026

Published
28 May 2026
Modified
17 June 2026
KEV Added
Patch
CVSS Score v3.1 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0021 11.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-9889 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Out of bounds read and write in Dawn in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Out-of-bounds read/write in Chrome renderer (Dawn) directly enables client-side exploitation for sandbox escape/privilege escalation via malicious HTML.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-16010Same product: Google Android
CVE-2021-4100Same product: Google Chrome
CVE-2023-4072Same product: Google Chrome
CVE-2021-0516Same product: Google Android
CVE-2023-3598Same product: Google Chrome
CVE-2021-0945Same product: Google Android
CVE-2022-2415Same product: Google Chrome
CVE-2020-16028Same product: Google Chrome
CVE-2020-16025Same product: Google Chrome
CVE-2022-3653Same product: Google Chrome

Affected Assets

google
chrome
≤ 148.0.7778.216

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

References