VulnSocial

CVE-2026-9973Patch(apple / chrome)

MEDIUMCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch apple chrome systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

apple CVEsBack to dashboard
5.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-787

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • chrome
  • linux_kernel
  • macos
  • windows

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-05-28); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
applegooglelinuxmicrosoft
Products
chromelinux_kernelmacoswindows

1 version affected across 4 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-28: 1Mentions · 2026-07-21: 1PoC Mentioned / Linked · 2026-07-21: 1Exploit Tool / Code · 2026-07-21: 1Patch / Workaround · 2026-05-28: 1Technical Details · 2026-05-28: 1Technical Details · 2026-07-21: 105-2807-21
Signal classification2 categories
Patch
150.0%
PoC
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-05-281
Patch1
2026-07-211
PoC1
Full discourse2 posts
  • itszn@itszn13
    Patch

    Chrome’s JavaScript engine V8 is getting harder and harder to find bugs in.. But powerful models still find a way! Yesterday’s Chrome release fixed CVE-2026-9973; A JIT loop optimization bug we found using gpt-5.5 in Codex. It had been around for over 2 years… https://t.co/GjGhgdLE3w

    Post summary

    Chrome’s V8 JIT loop optimization bug (CVE‑2026‑9973) was fixed in the latest release after being discovered using AI tools, with no evidence of active exploitation or PoC shared.

    541141512726.9K
    10.8K followersView on X
  • dbugs@ptdbugs
    PoC

    A PoC/exploit has been discovered for vulnerability CVE-2026-9973 PT ID: PT-2026-44681 Vendor: Google Product: Chrome Description: Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-44681 • https://github.com/jaf0rk/cve-2026-9973-exploit #dbugs_vuln

    Post summary

    A PoC and exploit for CVE‑2026‑9973, an out‑of‑bounds write in V8, has been released on GitHub; the vulnerability details are described but no patch or active exploitation is reported.

    02025121.5K
    3.4K followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
OSapplemacos---
Appgooglechrome---
OSlinuxlinux_kernel---
OSmicrosoftwindows---

Explore more

Back to dashboardapple CVEsgoogle CVEslinux CVEschrome vulnerabilities