VIR Vulnerability Intelligence Relay

CVE-2026-9986

medium
Published 2026-05-28 · Modified 2026-05-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
4.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
CVSS v4 NEW
—
not yet in upstream
VIR risk
4.2

Description

Insufficient validation of untrusted input in OptimizationGuide in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)

Predictions

Exploit likelihood
52%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

community-verified Authored 2026-05-29
{

Immediate action: Deploy Chrome 148.0.7778.216 or later. For air-gapped or staging environments, disable OptimizationGuide as interim control:

Windows (GPO):

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\OptimizationGuideServiceURL
Value: (empty string)

macOS/Linux (managed policy JSON):

{
  "OptimizationGuideServiceURL": "",
  "ComponentUpdatesEnabled": true
}

Test in isolated environment first—some users report slower page loads without optimization hints. Rollback: remove policy keys and restart Chrome.

Detection: Monitor Chrome crash logs for optimization_guide stack traces; abnormal dialog rendering may indicate exploitation attempts.

}

OS impact
OSVersionStatusFixed in
debian debianbookwormaffected
debian debianbullseyeaffected
debian debianforkyaffected
debian debiansidaffected
debian debiantrixieaffected
macos macos-not-affected
linux linux-kernel-not-affected

Application impact
VendorProductVersionsFixed
gcp googlechrome{"endExcluding":"148.0.7778.216"}148.0.7778.216
gcp googlechrome{"endExcluding":"148.0.7778.215"}148.0.7778.215

References

CWEs

CWE-20

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.