CVE-2026-9991
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allows a remote attacker who compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
Risk Assessment
An attacker can steal data from other domains (e.g., cookies, tokens) after compromising the renderer process, threatening user data confidentiality.
Recommendation
Update Google Chrome to version 148.0.7778.216 or later and consider restricting untrusted content execution.
Original NVD description (English source)
Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)