What is the CVSS score of CVE-2026-8517?

CVE-2026-8517 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8517?

Google Chrome on macOS (versions prior to 148.0.7778.168) contains a remote code execution vulnerability in the WebShare API that could allow attackers to compromise organizational systems through…. A patch is available.

How to fix or mitigate CVE-2026-8517?

Within 24 hours, conduct an inventory of Google Chrome versions on all macOS endpoints to identify systems running versions prior to 148.0.7778.168. Within 7 days, initiate phased deployment of Chrome 148.0.7778.168 or later, beginning with high-risk users and systems with administrative access. Complete full organizational deployment and validation within 30 days to ensure no systems remain on vulnerable Chrome versions.

Google Chrome CVE-2026-8517

EUVD-2026-30431 HIGH

Improper Control of a Resource Through its Lifetime (CWE-664)

2026-05-14 Chrome

GHSA-x28c-6463-7xg5

RCE Google

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N) with no privileges (PR:N) but requires specific victim UI gestures (UI:R); memory-corruption RCE yields high C/I/A within the browser process (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:49 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on macOS (versions prior to 148.0.7778.168) stems from an object lifecycle flaw in the WebShare API, allowing a remote attacker to run arbitrary code within the browser process after luring a victim to a crafted HTML page and getting them to perform specific UI gestures. Rated Critical by Chromium and reported internally by the Chrome team, a vendor patch is available; there is no public exploit identified at time of analysis, and the EPSS probability is very low (0.07%). CISA SSVC currently rates exploitation as none with total technical impact.

Technical ContextAI

The vulnerability lives in Chrome's WebShare implementation, the browser feature backing the navigator.share() Web API that lets web pages invoke the native OS share sheet on platforms like macOS. CWE-664 (Improper Control of a Resource Through its Lifetime) classifies the root cause as an object lifecycle error - typically a use-after-free or premature/dangling object reference where an object is used after being freed or before proper initialization. Because WebShare bridges JavaScript-triggered actions to native macOS share UI, a mismatch between the lifetime of the C++ backing objects and the asynchronous, user-driven share dialog can leave a dangling reference an attacker can groom. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped specifically to the macOS build per the description.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on macOS, per the Chrome Stable channel advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); most installations receive this automatically, so verify via chrome://settings/help and relaunch to apply. Red Hat and SUSE users should pull the corresponding updated Chrome package from their distribution channels. As an interim compensating control until the update is applied, restrict or disable the WebShare capability - for example via enterprise policy or by discouraging use of untrusted pages that trigger the OS share sheet - accepting the trade-off that the navigator.share() feature will be unavailable to legitimate sites; broader browsing restrictions and user awareness of not performing unexpected share/UI gestures on untrusted pages further reduce exposure.