What is the CVSS score of CVE-2026-8512?

CVE-2026-8512 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8512?

Google Chrome desktop contains a sandbox escape vulnerability (CVE-2026-8512, CVSS 8.3) affecting all versions before 148.0.7778.168, enabling remote attackers to corrupt memory and break out of…. A patch is available.

How to fix or mitigate CVE-2026-8512?

Within 24 hours, communicate mandatory Chrome update requirements and block known vulnerable versions from accessing corporate networks if technically feasible. Within 7 days, deploy Google Chrome version 148.0.7778.168 or later to all endpoints using your organization's patch management system, prioritizing users with access to sensitive systems or data. By day 30, verify complete deployment across Windows, macOS, and Linux endpoints and monitor endpoint protection logs for any exploitation attempts targeting FileSystem processes.

Google Chrome CVE-2026-8512

EUVD-2026-30425 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-8747-7f43-99gq

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via a web page (AV:N) with no auth (PR:N) but requiring specific user gestures (UI:R) and non-trivial memory grooming (AC:H); sandbox escape crosses a trust boundary (S:C) with full impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:51 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome desktop before 148.0.7778.168 stems from a use-after-free in the FileSystem component, letting a remote attacker who serves a crafted HTML page and coaxes the victim into specific UI gestures corrupt memory and break out of the renderer sandbox. Chromium rates it Critical, and the CVSS:3.1 8.3 score reflects a scope change (S:C) with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.07% (21st percentile).

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's FileSystem implementation, the Blink/browser-side subsystem that backs the sandboxed FileSystem/File API storage available to web content. A use-after-free occurs when a heap object is freed while a dangling reference remains, allowing later reuse of the stale pointer to read or write attacker-influenced memory. Because the affected code sits at the renderer-to-browser trust boundary (CPE cpe:2.3:a:google:chrome), successful exploitation can pivot from the constrained renderer sandbox into the higher-privileged browser process, which is why the CVSS scope is marked Changed. Chrome's multiprocess architecture treats such sandbox-escape UAFs as Critical because they defeat the primary containment layer that isolates untrusted web content from the host.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on all desktop platforms; Chrome auto-updates but the fix only takes effect after the browser is fully relaunched, so force-restart to apply it. Enterprises managing Chrome via policy should push the updated build and confirm the running version, and Red Hat/SUSE users should install the corresponding vendor-rebuilt Chromium/Chrome package once available. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. If patching must be delayed, reduce exposure by having users avoid untrusted sites and by deploying site-isolation/enterprise policies already default in Chrome; note there is no documented feature-level toggle to disable the FileSystem code path, so the only reliable fix is upgrading - mitigations short of that offer limited assurance given the sandbox-escape impact.