Is CVE-2026-9985 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9985 being exploited in the wild.

How severe is CVE-2026-9985?

Informational severity, with a CVSS score of 8.8, published 28 May 2026.

Which products and versions are affected?

Google ChromeOS prior to 148.0.7778.216.

Is there a fix for CVE-2026-9985?

A patch was published on 2026-05-27: Stable channel update released for desktop and ChromeOS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9985 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-9985?

Check whether you run Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9985: Google ChromeOS improper input validation in Media

CVE-2026-9985 · Severity: info · CVSS 8.8 · Published 2026-05-28

A security vulnerability in the media component of Google Chrome on ChromeOS could allow a remote attacker to access sensitive information from the device's memory. This occurs when a user visits a specially crafted website, potentially leading to the exposure of private data. Users should update their ChromeOS devices to version 148.0.7778.216 or later to mitigate this risk.

Technologies: Google ChromeOS. Vendors: Google.

Quick answers

Is CVE-2026-9985 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9985 being exploited in the wild.
How severe is CVE-2026-9985?: Informational severity, with a CVSS score of 8.8, published 28 May 2026.
Which products and versions are affected?: Google ChromeOS prior to 148.0.7778.216.
Is there a fix for CVE-2026-9985?: A patch was published on 2026-05-27: Stable channel update released for desktop and ChromeOS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9985 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-9985?: Check whether you run Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper input validation vulnerability (CWE-20) exists in the Media component of Google Chrome on ChromeOS. The flaw allows a remote attacker who has already compromised the renderer process to bypass memory protections and read sensitive information from process memory. Exploitation is achieved by enticing a user to visit a maliciously crafted HTML page. This vulnerability is rated as High severity by Chromium and was addressed in ChromeOS version 148.0.7778.216.

Affected products

Google ChromeOS prior to 148.0.7778.216

Timeline

2026-05-27: patched: Stable channel update released for desktop and ChromeOS
2026-05-28: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.