CVE Intelligence
Analysis AI-assisted

CVE-2026-9918: Google Chrome Tint Sandbox Escape via Inappropriate Implementation

An inappropriate implementation in the Tint component of Google Chrome before 148.0.7778.216 may allow a remote attacker to potentially escape the sandbox using a crafted HTML page. The CNA and CISA-ADP both list a CVSS 3.1 base score of 9.6 (critical), and the record does not list this CVE in CISA KEV. Updating Chrome to 148.0.7778.216 or later is the main defensive step.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

An inappropriate implementation in Tint, a component of Google Chrome, may allow a remote attacker to potentially escape the browser sandbox through a crafted HTML page. The record classifies the weakness as CWE-269 (Improper Privilege Management). The Chromium security severity is listed as High.

Impact

  • The record describes a potential sandbox escape triggered by a crafted HTML page.
  • The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, with a base score of 9.6 (critical) from both the CNA and CISA-ADP.
  • A sandbox escape can extend the impact beyond the browser process. The exact consequences depend on details not present in the record.

Affected products and versions

  • Product: Google Chrome.
  • The description identifies versions before 148.0.7778.216 as affected.
  • The affected range field in the record is internally inconsistent: it contains an entry for versions below 148.0.7778.216 and a second entry whose start and end are both 148.0.7778.216. The exact boundary should be confirmed against the vendor release notes.

Exploitation status

  • The record shows CISA KEV listed as false. No confirmed exploitation in the wild appears in the sources consulted.
  • The SSVC fields in the record show exploitation as none and automatable as no.
  • The EPSS probability is 0.00332 with a percentile of 0.25212, dated 2026-10-23.

Remediation and mitigation

  • Update Google Chrome to version 148.0.7778.216 or later. The Chrome stable channel release notes are listed as a reference in the record.
  • Apply the update through managed deployment channels and verify the installed version across all endpoints.
  • Until the update is applied, consider restricting browsing of untrusted sites on sensitive systems and minimizing unnecessary browser extensions. This is general guidance and an inference, not a vendor recommendation from the record.

Detection guidance

  • Inventory Chrome versions across the environment and flag any installation below 148.0.7778.216.
  • Review browser telemetry for crashes or unusual process activity as a general indicator. This is a high-level indicator and not a confirmed signature for this CVE.

Limitations of the available information

  • The record has no populated fixes field. The fixed version is taken from the description threshold and allowed versions list.
  • The affected version range is internally inconsistent, as described above.
  • The Chromium issue tracker entry is tagged Permissions Required, so public detail may be limited.
  • The record does not describe the exploitation technique, and none is provided here.
  • The EPSS date is later than the publication date, so the score should be interpreted with that in mind.

Frequently asked questions

Which Chrome versions are affected by this CVE?

The description states that Google Chrome versions before 148.0.7778.216 are affected. The affected range field in the record is internally inconsistent, so the exact boundary should be confirmed against the vendor release notes.

Is this vulnerability known to be exploited in the wild?

No. The record shows CISA KEV as false, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.