What is the CVSS score of CVE-2026-8515?

CVE-2026-8515 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8515?

A sandbox escape vulnerability in Google Chrome (CVE-2026-8515) prior to version 148.0.7778.168 could allow remote attackers to execute code on affected systems if users interact with a malicious…. A patch is available.

How to fix or mitigate CVE-2026-8515?

Within 24 hours, IT should identify Chrome desktop deployment across the organization and communicate the vulnerability to all users, emphasizing that it requires interaction with a crafted webpage; verify patch availability through your deployment method (Windows MSI, macOS, mobile MDM, or auto-update channel). Commence deployment of Chrome 148.0.7778.168 or later within 7 days using standard patch management, prioritizing high-value endpoints and systems with privileged access. By day 30, confirm 100% patch compliance across all Chrome installations using endpoint inventory or mobile device management tools, and reinforce security awareness training on phishing and malicious link risks given the social engineering component.

Google Chrome CVE-2026-8515

EUVD-2026-30428 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-57r7-2v6h-4x36

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered crafted page (AV:N) requires user gestures (UI:R) and heap-grooming reliability (AC:H) with no auth (PR:N); sandbox escape crosses trust boundary (S:C) enabling full compromise.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:50 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome desktop before 148.0.7778.168 stems from a use-after-free in the WebHID implementation, letting a remote attacker who lures a victim into specific UI gestures on a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. Chromium rates the severity Critical, though no public exploit is identified and EPSS is very low (0.07%). Exploitation requires user interaction and is not automatable, indicating a high-skill rather than mass-exploited threat.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's HID (Human Interface Device) subsystem, which backs the WebHID API used by web pages to communicate with connected HID peripherals (keyboards, gamepads, custom USB devices) after a user grants device access. A use-after-free occurs when a freed object is referenced again, allowing an attacker to reclaim that memory and gain control over object contents; in the context of the browser's IPC/device brokering layer this can be leveraged toward a sandbox escape, meaning code influence outside the constrained renderer. The affected component is identified by cpe:2.3:a:google:chrome:*, i.e. the Chrome desktop browser across pre-148.0.7778.168 builds.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on Windows, macOS, and Linux via the Stable Channel update, then restart the browser to apply it (see https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html). Because Chrome auto-updates, ensure managed fleets are not pinned to an older build and force a relaunch to complete installation; users of Chromium-based distributions from Red Hat and SUSE should pull the corresponding vendor package updates. As an interim compensating control before patching, restrict or disable WebHID access via enterprise policy (e.g., DefaultWebHidGuardSetting / WebHidBlockedForUrls or blocking hid device access), which removes the attack surface at the cost of breaking legitimate web apps that use HID peripherals; user awareness against performing unusual UI gestures on untrusted pages further reduces the UI:R-dependent trigger.