CVE-2026-9116
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a Chromium security severity of High.
Risk Assessment
An attacker could exploit this vulnerability to steal sensitive user data, such as session tokens or personal information, from other websites visited in the browser. The risk is high due to the ease of exploitation via a simple HTML page.
Recommendation
Immediately update Google Chrome to version 148.0.7778.179 or later. Also advise users to perform the update as soon as possible.
Original NVD description (English source)
Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)