What is the CVSS score of CVE-2026-8513?

CVE-2026-8513 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8513?

Google Chrome for Android versions prior to 148.0.7778.168 contain a use-after-free vulnerability enabling sandbox escape if the renderer process is compromised.. A patch is available.

How to fix or mitigate CVE-2026-8513?

Within 24 hours, audit Chrome versions across your Android fleet via MDM to identify devices running versions before 148.0.7778.168. Within 7 days, deploy Chrome 148.0.7778.168 or later through your MDM to all Android endpoints, prioritizing devices with elevated permissions or access to sensitive systems. Within 30 days, establish automated compliance monitoring to detect any devices that revert to vulnerable versions and verify patch adoption across 100% of your managed Android fleet.

Google Chrome CVE-2026-8513

EUVD-2026-30424 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-2gj8-f8hj-pwwh

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a pre-existing renderer compromise so PR:L rather than PR:N, AC:H for unreliable heap grooming, UI:R for loading the page, and S:C for the sandbox escape with high CIA impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.0 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:50 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome for Android before 148.0.7778.168 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Input component to break out of the sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, this is a second-stage bug requiring an existing renderer compromise rather than a standalone remote exploit. EPSS is very low (0.07%) and there is no public exploit identified at time of analysis; SSVC records no observed exploitation.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Input handling code, part of the Blink/Chromium browser engine that processes user input events and their associated objects. On Android, Chrome runs renderer processes in a restricted sandbox; a use-after-free reachable from the sandboxed renderer can be groomed to corrupt memory in a more privileged context, enabling escape from the renderer sandbox. The single CPE provided (cpe:2.3:a:google:chrome) is generic, but the description explicitly scopes impact to the Android build prior to 148.0.7778.168. Use-after-free bugs arise when a pointer to freed heap memory is reused, allowing an attacker who controls subsequent allocations to hijack object state or control flow.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 148.0.7778.168 or later, which is the primary and definitive fix; on Android this is delivered through the Google Play Store, so ensure automatic app updates are enabled and force an update on managed fleets via MDM. Verify the running version under Chrome settings > About Chrome. Because exploitation requires a prior renderer compromise, the most effective compensating control until patched is to reduce renderer-compromise exposure: restrict browsing to trusted sites, deploy enterprise policies to block risky content, and consider enabling Chrome's stricter site-isolation/enhanced protection settings, accepting the trade-off of some site-compatibility friction. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html and the Chromium issue at https://issues.chromium.org/issues/495939973 for release tracking.