CVE-2026-9117
Type Confusion in GFX in Google Chrome on Linux
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Chrome
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome | to 148.0.7778.179 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-843 | The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a type confusion issue in the GFX component of Google Chrome on Linux and ChromeOS versions prior to 148.0.7778.179. It allows a remote attacker who has already compromised the renderer process to potentially escape the browser's sandbox by using a specially crafted video file.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to escape the sandbox environment of the browser, potentially gaining higher privileges on the affected system. This could lead to full system compromise, including unauthorized access to sensitive data, installation of malware, or further attacks on the system.