Listen to this Post
CVE-2026-9991 is a high-severity vulnerability affecting Google Chrome on Windows prior to version 148.0.7778.216. The flaw exists within the Media component’s implementation, specifically in how the renderer process handles cross-origin resource requests for audio and video elements. To trigger this issue, a remote attacker must first compromise the renderer process, usually by exploiting a separate memory corruption bug like a use-after-free or heap overflow. Once the renderer is compromised, the attacker gains control over its execution context and can inject a crafted HTML page into the browsing session. The Media pipeline in Chrome normally enforces the Same-Origin Policy (SOP) for loading and manipulating media resources from different origins. However, due to inappropriate implementation, certain security checks are bypassed when the renderer processes media-related events and error states. Specifically, the binding layer between the Blink rendering engine and the underlying media stack fails to properly validate the origin of the requesting frame when handling cross-origin media requests. This allows the compromised renderer to request a media resource from a different origin and observe differences in response timing, error messages, or byte-range retrieval patterns. By measuring the duration of `onload` versus `onerror` events, or by leveraging partial content responses (HTTP 206), the attacker can infer the presence or absence of specific data on the target origin. This effectively leaks cross-origin information, breaking the fundamental security boundary of the browser. The vulnerability is Windows-specific because the underlying media pipeline implementation on that platform includes additional optimizations and code paths that diverge from Linux or macOS, making the bypass viable only there. The Chromium security team rated this as High severity due to the potential for sensitive data exposure without user interaction. NIST published the CVE on May 28, 2026, and the fix was backported to the stable channel shortly after. Enterprises relying on Chrome for handling sensitive internal web applications are particularly at risk, as an attacker could exfiltrate session tokens or confidential API responses from other tabs or origins.
DailyCVE Form:
Platform: Google Chrome Windows
Version: < 148.0.7778.216
Vulnerability : Cross-origin data leak
Severity: High
date: 28 May 2026
Prediction: Patch version 148.0.7778.216
What Undercode Say:
Bash command to check installed Chrome version on Windows (via WSL or Git Bash)
powershell.exe -Command “(Get-Item ‘C:\Program Files\Google\Chrome\Application\chrome.exe’).VersionInfo.FileVersion”
Bash script to compare against vulnerable version
CHROME_VER=$(powershell.exe -Command “(Get-Item ‘C:\Program Files\Google\Chrome\Application\chrome.exe’).VersionInfo.FileVersion” | tr -d ‘\r’)
if [[ “$CHROME_VER” < "148.0.7778.216" ]]; then
echo “Vulnerable to CVE-2026-9991”
else
echo “Patched”
fi
JavaScript code snippet that demonstrates the information leak via media requests
const leak = (url) => {
const video = document.createElement(‘video’);
video.crossOrigin = ‘anonymous’;
video.onload = () => console.log(‘[+] Resource exists on target origin’);
video.onerror = (e) => console.log(‘[-] Resource missing or blocked’);
video.src = url;
video.load();
};
// Attacker-controlled renderer calls this with a cross-origin URL
leak(‘https://internal.corporate.com/api/sensitive’);
Exploit: (Educational Purposes!)
- Exploit an initial memory corruption vulnerability to achieve remote code execution inside the Chrome renderer process.
- Once the renderer is compromised, inject the crafted HTML payload containing a `
- Set the `src` attribute of the media element to a cross-origin URL that contains sensitive data or acts as a probe endpoint.
- Override the native event handlers (
onload,onerror,ontimeupdate) to capture response metadata such as duration, buffered ranges, or error codes. - Use the differences in event timing and available byte ranges to reconstruct the existence, size, or partial content of the cross-origin resource.
- Exfiltrate the inferred data to the attacker-controlled command-and-control server via WebSocket or beacon requests.
Protection: from this CVE
Upgrade Google Chrome on Windows to version 148.0.7778.216 or any later release immediately. Enable the `–enable-features=StrictOriginIsolation` flag to enforce additional cross-origin checks, and activate the `–site-per-process` policy to ensure each site runs in a dedicated renderer, limiting the blast radius if one process is compromised. Administrators can deploy group policies to force automatic updates and block execution of older, vulnerable versions.
Impact:
Successful exploitation allows an attacker who controls a compromised renderer process to read cross-origin data that should be inaccessible under the Same-Origin Policy. This can lead to the leakage of authentication cookies, OAuth tokens, internal API responses, user profile information, and other sensitive content from any origin the victim has open in other tabs or windows. The flaw can be weaponized in drive-by attacks where a user visits a malicious page, leading to credential theft, session hijacking, and unauthorized access to internal corporate resources.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
