What is the CVSS score of CVE-2026-8519?

CVE-2026-8519 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8519?

Google Chrome on Windows contains a critical memory corruption vulnerability (CVE-2026-8519) in the ANGLE graphics layer that allows remote code execution when users visit a malicious webpage.. A patch is available.

How to fix or mitigate CVE-2026-8519?

Within 24 hours: assess total Windows Chrome deployment footprint, identify business-critical users, and brief IT/security leadership on remediation scope. Within 7 days: deploy Chrome version 148.0.7778.168 or later to all Windows systems through your standard patch management process, prioritizing corporate endpoints and VPN users. Within 30 days: verify patch compliance across all Windows endpoints via inventory systems, review browser crash logs and memory dumps for exploitation indicators, and document exceptions for audit.

Google Chrome CVE-2026-8519

EUVD-2026-30433 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-14 Chrome

GHSA-4mpw-x48v-q2m5

Buffer Overflow Google Microsoft

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs only a victim visit (AV:N/AC:L/PR:N/UI:R); memory corruption stays in the sandboxed renderer (S:U) with high C/I/A from potential code execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:48 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Out-of-bounds memory write in Google Chrome's ANGLE graphics abstraction layer on Windows before 148.0.7778.168 lets a remote attacker corrupt memory by luring a victim to a crafted HTML page, potentially leading to renderer-process code execution. Rated Critical by Chromium and scored CVSS 8.8, it requires user interaction (visiting a page) but no authentication. Currently there is no public exploit identified and the SSVC exploitation status is 'none', though the very low EPSS (0.07%) reflects newness rather than confirmed safety.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map WebGL/OpenGL ES calls onto native backends (Direct3D on Windows), so it processes untrusted graphics commands originating from web content. The root cause is CWE-472-adjacent integer overflow arithmetic (the description explicitly states an integer overflow) that miscomputes a buffer size or offset, resulting in an out-of-bounds write. Because ANGLE runs inside the sandboxed renderer on Windows, the immediate memory-corruption primitive is contained by Chrome's site isolation and sandbox, but such bugs are historically chained with sandbox escapes for full compromise. The affected CPE is cpe:2.3:a:google:chrome, i.e., the desktop Chrome browser, with the flaw specific to the Windows build per the advisory.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on Windows via the Stable channel update (http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); most installations receive this automatically, so verify the version under chrome://settings/help and relaunch to apply. For Chromium-based derivatives (Edge, and Red Hat/SUSE Chromium packages noted in the tags), apply the corresponding vendor build once released. If patching must be delayed, reduce exposure by restricting untrusted browsing and, as a targeted compensating control, disabling hardware-accelerated graphics (chrome://settings 'Use graphics acceleration when available' off, or the --disable-gpu / SwiftShader fallback) to limit ANGLE's exposure to attacker-controlled GPU command paths - with the trade-off of degraded WebGL/graphics performance and increased CPU use. Enterprise policy can also enforce site isolation and block WebGL via the WebGL/3D-APIs policy to shrink the attack surface until the update is deployed.