What is the CVSS score of CVE-2026-8014?

CVE-2026-8014 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8014?

Yes, a patch is available for CVE-2026-8014. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8014

EUVD-2026-28131 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Information Disclosure Google

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page with no privileges needed (PR:N), active user navigation required (UI:R), and impact limited to partial confidentiality leak with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:31 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.3 (MEDIUM)

CVE Published

May 06, 2026 - 18:13 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Preload in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's Preload subsystem (prior to 148.0.7778.96) allows a remote attacker to infer cross-origin information by luring a victim to a crafted HTML page. The flaw is a protection mechanism failure (CWE-693) in Chrome's speculative resource-fetching logic, breaking expected Same-Origin Policy isolation. No public exploit code exists and CISA has not listed this in KEV; an EPSS of 0.03% (9th percentile) and an SSVC exploitation rating of 'none' confirm negligible real-world exploitation interest at time of analysis.

Technical ContextAI

The vulnerability lies in Chrome's Preload subsystem - the browser engine component responsible for speculative resource fetching initiated by mechanisms such as 'link rel=preload' or Speculation Rules. CWE-693 (Protection Mechanism Failure) indicates that a security control enforcing cross-origin isolation within this subsystem was implemented incorrectly, allowing a crafted page to observe or infer data belonging to a different origin. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions on all platforms prior to 148.0.7778.96. Downstream Linux distribution package maintainers at Red Hat and SUSE have also tracked this issue, indicating it affects Chrome as packaged in enterprise Linux environments in addition to the upstream Chromium-based binary.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later using the browser's built-in update mechanism (Menu → Help → About Google Chrome) or via the stable channel release described at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Red Hat and SUSE enterprise users should apply updated Chromium or Chrome browser packages from their respective distribution security channels once those packages become available. No practical user-facing workaround exists to disable Preload in standard Chrome configurations without enterprise policy intervention; disabling speculative loading via enterprise policy (e.g., setting NetworkPredictionOptions) would mitigate the vector but degrade page load performance and is not warranted given the low severity. Given the EPSS near-zero and absence of active exploitation, this vulnerability is appropriate for inclusion in the next routine patch cycle rather than emergency remediation.