What is the CVSS score of CVE-2026-8518?

CVE-2026-8518 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8518?

Google Chrome desktop versions before 148.0.7778.168 contain a use-after-free vulnerability (CVSS 8.8) in the Blink rendering engine that could allow attackers to execute arbitrary code within the…. A patch is available.

How to fix or mitigate CVE-2026-8518?

Within 24 hours, confirm Chrome version inventory and test Google Chrome 148.0.7778.168 deployment in a non-production environment for compatibility with critical business applications. Within 7 days, deploy Chrome 148.0.7778.168 or later to all desktop endpoints via your patch management system, prioritizing systems with internet-facing roles. Within 30 days, verify deployment success across the enterprise (target: >95% coverage), correlate browser telemetry for any exploitation indicators, and formally close the remediation ticket.

Google Chrome CVE-2026-8518

EUVD-2026-30430 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-3p4x-fwpx-xpr8

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges but requires the user to open it (UI:R); code stays in the renderer sandbox (S:U) yet fully compromises it, so C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:49 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Renderer-side arbitrary code execution in Google Chrome desktop before 148.0.7778.168 stems from a use-after-free in the Blink rendering engine, letting a remote attacker who lures a victim to a crafted HTML page run code within the browser's renderer sandbox. Chromium rates the flaw Critical severity; however, exploitation still requires the user to open a malicious page (UI:R), the code executes inside the sandbox (scope unchanged), and there is no public exploit identified at time of analysis. EPSS is low (0.08%, 23rd percentile) and CISA SSVC records exploitation as 'none', so this is a high-severity but not yet actively exploited issue.

Technical ContextAI

The defect is a CWE-416 use-after-free in Blink, the C++ rendering engine that parses HTML/CSS and builds the DOM inside Chrome's renderer process. Use-after-free bugs arise when a heap object is freed while a dangling pointer still references it; an attacker who reclaims that freed memory with attacker-controlled data can corrupt object state and, in Blink's case, achieve control-flow hijacking during page rendering. The affected component is Google Chrome (cpe:2.3:a:google:chrome:*), and because Blink is shared across the Chromium project, downstream Chromium-based browsers and the noted redistributors (Red Hat, SUSE ship Chromium/Chrome packages) may require corresponding updates. Critically, the description states code executes 'inside a sandbox,' meaning this bug alone does not escape Chrome's renderer sandbox and would need to be chained with a separate sandbox-escape to compromise the host.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on all desktop platforms (Windows, macOS, Linux) via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html; the browser normally auto-updates, so ensure Chrome is fully restarted to apply the new build and verify the version under chrome://settings/help. For Chromium repackagers, apply the equivalent updated packages from Red Hat and SUSE. If patching must be briefly delayed, reduce exposure by having users avoid untrusted sites and by enabling Chrome's 'Enhanced Protection' Safe Browsing mode, which adds real-time blocking of malicious pages; note this sends more browsing data to Google. As a stronger interim control, deploy the SitePerProcess/site-isolation and renderer-sandbox enforcement (default on) and restrict browsing via enterprise policy or web proxy allowlists - trade-off being reduced user browsing freedom until the update is confirmed deployed.