What is the CVSS score of CVE-2026-8514?

CVE-2026-8514 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8514?

Google Chrome's sandbox escape vulnerability creates a critical escalation path for attackers: once the browser is compromised via a web attack, the attacker can break out of Chrome's security…. A patch is available.

How to fix or mitigate CVE-2026-8514?

Within 24 hours, issue a security advisory to all Chrome users and IT administrators, and inventory currently deployed Chrome versions across the organization. Within 7 days, prioritize deployment of Google Chrome version 148.0.7778.168 or later to all endpoints, beginning with systems handling sensitive data or belonging to high-risk user populations. Within 30 days, complete organization-wide patch verification and implement EDR detection signatures for abnormal renderer process behavior or sandbox escape indicators.

Google Chrome CVE-2026-8514

EUVD-2026-30429 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-cg64-j5p6-4xrq

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered crafted page (AV:N) needing user interaction (UI:R) and reliable UAF heap control plus a prior renderer compromise (AC:H); sandbox escape crosses a security boundary (S:C) with full host impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:50 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's Aura windowing subsystem (versions prior to 148.0.7778.168) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, it is a use-after-free (CWE-416) that serves as the second stage of an exploit chain rather than an initial entry point. There is no public exploit identified at time of analysis, and EPSS is very low (0.07%), consistent with a patched, chain-dependent bug.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Aura, Chromium's cross-platform window and input-event abstraction layer that manages UI surfaces, focus, and event routing on desktop platforms. A use-after-free occurs when memory is freed but a dangling pointer to it is later dereferenced, allowing an attacker to control freed-then-reallocated memory to corrupt object state or hijack control flow. Because Aura logic runs on the browser/GPU side of Chrome's multi-process architecture - outside the renderer sandbox - a renderer that has been compromised can drive Aura into the vulnerable state to reach higher-privileged code. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome desktop browser across all editions below the fixed build.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later (the fixed stable build), then relaunch the browser to apply it, per Google's advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Enterprises should confirm managed auto-update is enabled and force a restart via policy, and consumers should verify the version under chrome://settings/help. For Red Hat and SUSE users, apply the corresponding distribution's Chromium/Chrome update once published. No standalone workaround fully removes the flaw, but because exploitation requires a compromised renderer, layered hardening reduces exposure: keep Chrome's Site Isolation enabled (default) so renderer compromise is harder to leverage, avoid disabling the sandbox, and restrict users from loading untrusted content - with the trade-off that these reduce, not eliminate, risk and are no substitute for the version upgrade.