Heap buffer overflow in WebRTC in Google Chrome on prior to 148

CVE-2026-9119 is a heap-based buffer overflow in Chrome's WebRTC component that can be triggered by attacker-controlled web content. Google and NVD describe the outcome as arbitrary code execution inside Chrome's sandbox via a crafted HTML page. The affected range is Chrome before 148.0.7778.179, with Google's May 19, 2026 desktop release notes showing 148.0.7778.178/179 for Windows/Mac and 148.0.7778.178 for Linux; Debian also backported fixes for Chromium.

The vendor's 8.8/HIGH is fair if you score the bug in isolation as remote code execution in a ubiquitous browser, but it overstates enterprise endpoint risk. The decisive reality is that exploitation lands in a sandboxed renderer, not straight on the host, and the attack still needs user interaction with malicious content. That combination makes this important patching work, but not an all-hands emergency absent a public exploit chain or sandbox escape.

Why this verdict

• Sandboxed renderer only: Google and NVD both state the result is code execution *inside a sandbox*. Starting from the vendor's 8.8, that is the biggest downward adjustment because it limits blast radius unless chained with a second bug.
• User interaction required: This is UI:R, so the attacker still needs a victim to render malicious content. That implies phishing, malvertising, or compromised-site delivery rather than direct reach into every endpoint.
• Client-side, not internet-exposed infrastructure: There is no server socket to scan, spray, or mass-exploit the way you would with VPNs, firewalls, or public web apps. Real exposure depends on user behavior and browser version hygiene.
• Threat intel is quiet: No KEV listing, no public exploitation evidence found, and the supplied EPSS (0.00022) is extremely low. That does not make the bug harmless, but it removes the urgency premium.
• Still not LOW: Chrome is ubiquitous and the bug is remotely delivered with no auth and low complexity once a user hits the page. In a 10,000-host estate, even moderate user-driven reach means you still want broad patch compliance.

Why not higher?

This is not a higher bucket because the attack chain has two compounding brakes: user interaction and sandboxed-only code execution. Treating it like a full endpoint takeover would ignore the fact that the attacker still needs either a second vulnerability or a very specific post-exploitation objective inside the renderer.

Why not lower?

This is not lower because it is still a memory-corruption bug in a massively deployed browser with remote content delivery and no authentication requirement. Even without public exploitation, a well-resourced attacker can realistically target high-value users through normal browsing paths.

1. Enforce browser auto-update compliance — Make sure Chrome/Chromium update policies are actually landing on managed endpoints and VDI images. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this is the cleanest way to collapse exposure across a large fleet.
2. Harden risky browsing tiers — For admins, executives, developers, and help-desk users, apply stricter browser policy: keep sandboxing and Site Isolation defaults intact, restrict unmanaged extensions, and consider browser isolation for high-risk web access. There is no mitigation SLA for MEDIUM, so use this as a targeted interim reduction while normal patching completes within the 365-day remediation window.
3. Limit WebRTC where the business does not need it — If a user group does not rely on browser-based calling, conferencing, or data channels, reducing WebRTC reach can break the vulnerable code path. Use this selectively; there is no mitigation SLA for MEDIUM, so this is an optional risk reduction, not an emergency control.
4. Watch browser version drift — Continuously report endpoints still below the fixed build, especially non-persistent VDI, kiosks, lab systems, and Linux packages that lag behind the enterprise channel. For MEDIUM, drive this through standard remediation within the 365-day window instead of war-room operations.

Run this on the target endpoint or in your software-audit tooling. Invoke it with python3 check_cve_2026_9119.py to auto-detect Chrome/Chromium, or pass an explicit path such as python3 check_cve_2026_9119.py "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"; no admin rights are normally required unless your EDR blocks process inspection.

#!/usr/bin/env python3
# check_cve_2026_9119.py
# Determine whether a local Chrome/Chromium binary is vulnerable to CVE-2026-9119.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')

FIXED_WINDOWS_MAC = (148, 0, 7778, 179)
FIXED_LINUX = (148, 0, 7778, 178)


def parse_version(text):
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def candidates():
    system = platform.system().lower()
    c = []

    if len(sys.argv) > 1:
        c.append(sys.argv[1])

    # PATH-based binaries
    for name in [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser',
        'chrome', 'msedge'  # included only so the script can tell you UNKNOWN/not-applicable if pointed there
    ]:
        p = shutil.which(name)
        if p:
            c.append(p)

    if system == 'windows':
        envs = [
            os.environ.get('PROGRAMFILES'),
            os.environ.get('PROGRAMFILES(X86)'),
            os.environ.get('LOCALAPPDATA')
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe'
        ]
        for base in envs:
            if base:
                for s in suffixes:
                    c.append(os.path.join(base, s))
    elif system == 'darwin':
        c.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium'
        ])
    else:
        c.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
            '/snap/bin/chromium'
        ])

    # de-dup while preserving order
    seen = set()
    out = []
    for item in c:
        if item and item not in seen:
            seen.add(item)
            out.append(item)
    return out


def get_version(binary):
    try:
        cp = subprocess.run([binary, '--version'], capture_output=True, text=True, timeout=10)
        text = (cp.stdout or '') + ' ' + (cp.stderr or '')
        return parse_version(text), text.strip()
    except Exception:
        return None, ''


def main():
    system = platform.system().lower()
    fixed = FIXED_LINUX if system == 'linux' else FIXED_WINDOWS_MAC

    found_any = False
    for binary in candidates():
        if not os.path.exists(binary):
            continue
        found_any = True
        ver, raw = get_version(binary)
        if ver is None:
            continue

        # Basic product sanity check
        lowered = raw.lower()
        if 'edge' in lowered:
            print(f'UNKNOWN: {binary} appears to be Microsoft Edge, not Chrome/Chromium ({raw})')
            sys.exit(2)

        status = 'PATCHED' if cmp_ver(ver, fixed) >= 0 else 'VULNERABLE'
        print(f'{status}: {binary} version {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]}')
        sys.exit(0 if status == 'PATCHED' else 1)

    if not found_any:
        print('UNKNOWN: no Chrome/Chromium binary found; pass an explicit path as an argument')
    else:
        print('UNKNOWN: found candidate binary but could not parse a version')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (May 19, 2026)
2. NVD - CVE-2026-9119
3. Chromium Design Doc - Multi-process Architecture
4. Chromium Security - Site Isolation
5. Debian Security Tracker - CVE-2026-9119
6. FIRST EPSS Data and Statistics
7. CISA Known Exploited Vulnerabilities Catalog