CVE Intelligence
Analysis AI-assisted

CVE-2026-9874: Google Chrome Dawn Use-After-Free Vulnerability

CVE-2026-9874 is a use-after-free in the Dawn component of Google Chrome before 148.0.7778.216, classified as CWE-416. A remote attacker could potentially escape the sandbox by luring a user to a crafted HTML page. The record gives a CVSS 3.1 score of 9.6 and lists no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes a use-after-free (CWE-416) in Dawn, a component of Google Chrome, in builds prior to 148.0.7778.216. It was published on 2026-05-28 and has NVD status Analyzed.

Impact

According to the description, a remote attacker could potentially perform a sandbox escape by using a crafted HTML page. The CVSS 3.1 base score is 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, which in standard CVSS terms indicates network exploitation, no privileges required, user interaction required, a changed scope and high impact on confidentiality, integrity and availability. The SSVC fields list technical impact as total, exploitation as none and automatable as no.

Affected products and versions

  • Product: Google Chrome.
  • Described as affected before 148.0.7778.216.
  • The affected-version data in the record is inconsistent: one entry describes a range that starts and ends at the same version, so the exact boundary should be confirmed in the vendor advisory.
  • The record lists no fixed versions. The description implies that 148.0.7778.216 is the first unaffected release, which is an inference.

Exploitation status

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00319 with a percentile of 0.23723. The SSVC exploitation field is none and automatable is no.

Remediation and mitigation

  • Update Google Chrome to version 148.0.7778.216 or later, following the vendor advisory linked below.
  • Keep automatic browser updates enabled and confirm that managed endpoints have received the update.
  • In higher-sensitivity environments, limit browsing of untrusted web content until patching is complete.

Detection guidance

  • Inventory Chrome versions across the estate and flag any installation older than 148.0.7778.216.
  • Review endpoint telemetry for unusual browser process behaviour after users open unfamiliar web links, without relying on any specific exploit pattern.

Limitations of the available information

The record has no English title, no fixed-version field and no detail beyond the description. The linked Chromium issue tracker entry is marked as requiring permissions, so its contents could not be reviewed. The EPSS date (2026-10-23) is later than the publication date and should be verified before use.

Frequently asked questions

Is CVE-2026-9874 being actively exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which Chrome version fixes this issue?

The description states that versions before 148.0.7778.216 are affected, which indicates that 148.0.7778.216 or later is the expected fix. The record does not include a formal fixed-version field, so confirm it in the vendor advisory.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.