What is the CVSS score of CVE-2026-8001?

CVE-2026-8001 has a contested CVSS base score of 8.3 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-8001?

Google Chrome versions prior to 148.0.7778.96 contain a sandbox escape vulnerability affecting Linux, Mac, and ChromeOS systems that allows attackers who have already compromised the renderer process…. A patch is available.

How to fix or mitigate CVE-2026-8001?

Within 24 hours: Inventory all Chrome deployments across Windows, macOS, and Linux endpoints and identify versions below 148.0.7778.96. Within 7 days: Deploy Chrome 148.0.7778.96 or later across all endpoints using your existing patch management system or Chrome's auto-update mechanism. Within 30 days: Validate 100% deployment completion and document remediation in your vulnerability tracking system.

Google Chrome CVE-2026-8001

EUVD-2026-28105 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Google Denial Of Service Use After Free Memory Corruption Red Hat Suse Chrome

High

Disputed · 8.3 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:35 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.3

DescriptionCVE.org

Use After Free in Printing in Google Chrome on Linux, Mac, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome prior to 148.0.7778.96 on Linux, Mac, and ChromeOS allows remote attackers who have already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page exploiting a use-after-free vulnerability in the printing subsystem. Despite the 8.3 CVSS score, Chromium rates this Low severity because exploitation requires a two-stage attack chain (initial renderer compromise followed by sandbox escape). Vendor patch released as Chrome 148.0.7778.96. No evidence of active exploitation or public POC identified at time of analysis.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) memory corruption flaw in Chrome's printing implementation, affecting the Linux, macOS, and ChromeOS builds. Use-after-free vulnerabilities occur when code continues to use a memory pointer after the memory has been freed, allowing attackers to manipulate heap memory structures. In Chrome's multi-process architecture, renderer processes handle untrusted web content in a restricted sandbox, while privileged browser processes operate outside the sandbox. This flaw specifically enables sandbox escape - a critical security boundary breach that converts a contained renderer exploit into full system compromise. The printing subsystem likely triggers the freed memory reference during document rendering or print preview operations, creating an exploitable window for heap manipulation.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later, available through Chrome's automatic update mechanism (chrome://settings/help) or direct download from google.com/chrome. The vendor-released patch addresses the use-after-free in the printing subsystem. Chrome's automatic update system typically deploys patches within 24-48 hours for most users. Full advisory details available at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. No workaround is documented because the flaw resides in core browser functionality. Organizations unable to patch immediately should consider compensating controls: deploy browser isolation technologies that contain exploits even after sandbox escape, restrict Chrome usage to trusted sites via allowlisting policies, or enforce Chromium-based alternatives already at version 148.0.7778.96+. Note that disabling printing functionality is not a viable mitigation as Chrome does not expose granular feature controls for the affected subsystem, and blocking print operations would severely impact user workflows.