CVE-2026-9898

HighCVSS 8.3/10Last modified Jul 21, 2026

Description

Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2026
Last modified
Jul 21, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-989808.8In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentCVE-2026-989818.8In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(),CVE-2026-989827.8In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloCVE-2026-98983In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken CVE-2026-98984In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir(CVE-2026-98985In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot_root(CVE-2026-98986In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process coCVE-2026-98987In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attachCVE-2026-989888.8In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE open_treCVE-2026-98989In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_lCVE-2026-98998.3Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenCVE-2026-98990In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it
CVE-2026-9898: High severity, CVSS 8.3 | Vulnix