CVE Intelligence
Analysis AI-assisted

CVE-2026-9967: Google Chrome GPU out-of-bounds write leading to possible sandbox escape

CVE-2026-9967 is an out-of-bounds write in the GPU component of Google Chrome that a remote attacker could potentially use to escape the sandbox through a crafted HTML page. The record shows a critical rating with a CVSS 9.6 score, and the affected range ends before 148.0.7778.216. The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-9967 is an out-of-bounds write in the GPU component of Google Chrome, mapped to CWE-787. According to the record, a remote attacker could potentially use a crafted HTML page to attempt a sandbox escape. The Chromium security severity is rated High. The vendor release notes are the main public reference: Chrome Releases stable channel update.

Impact

  • The CVSS 9.6 score reflects network reachability, low complexity, no privileges required, user interaction required, a changed scope, and high impact on confidentiality, integrity and availability.
  • A sandbox escape would let code running inside a browser process reach resources beyond the sandbox boundary. The exact consequences depend on the chain required, which the record does not describe.

Affected products and versions

  • Product: Google Chrome.
  • The record lists the affected range as versions before 148.0.7778.216, and also lists 148.0.7778.215 among the affected entries.
  • The record contains a contradictory third entry, a range described as both at least 148.0.7778.216 and before 148.0.7778.216. It cannot be interpreted precisely and should be verified against the vendor advisory.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • SSVC fields in the record show exploitation as none and automatable as no. The EPSS probability is 0.00345 with a percentile of 0.26842.

Remediation and mitigation

  • Update Google Chrome to 148.0.7778.216 or later, since that version is the boundary of the affected range. Confirm the installed build through the browser's version page or your fleet management tool.
  • Prioritize endpoints where users browse untrusted sites or where Chrome runs in privileged or shared contexts.
  • Keep automatic updates enabled where possible and verify that managed browsers receive the stable channel update.

Detection guidance

  • Inventory Chrome versions across the environment and flag any build below the boundary version.
  • Review browser telemetry for GPU process crashes or unexpected renderer terminations. These signals are not specific to this flaw, so treat them as context only.
  • Monitor for unusual process activity from the browser after users open links from untrusted sources, at a high level.

Limitations of the available information

  • The record has an empty fixes list. The boundary version is an inference, not an explicit fixed-version statement.
  • The Chromium issue tracker link requires permissions, so its detailed content was not available.
  • The record provides no exploit details, proof of concept or additional technical analysis.
  • Whether the sandbox escape needs additional vulnerabilities is unknown.

Frequently asked questions

Is CVE-2026-9967 being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which Chrome build should I install?

The affected range ends before 148.0.7778.216, so that build or later is the boundary version. The record has no explicit fixed-version field, so confirm against the vendor release notes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.