What is the CVSS score of CVE-2026-8520?

CVE-2026-8520 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8520?

A high-severity sandbox escape vulnerability in Google Chrome (before v148.0.7778.168) allows attackers to fully compromise user browsers by directing victims to malicious webpages, creating an…. A patch is available.

How to fix or mitigate CVE-2026-8520?

Immediately deploy Google Chrome version 148.0.7778.168 to all endpoints within 24 hours through your patch management system or forced browser updates, prioritizing high-risk populations in finance, development, and administrative roles. Validate 100% deployment completion within 7 days using endpoint reporting and chrome://version checks, escalating any systems remaining on older versions for manual remediation. Over the next 30 days, monitor security logs and proxy data for exploitation signatures (sandboxed-process escape patterns, renderer crashes with specific timing), and conduct a post-incident review of any anomalies detected before patching.

Google Chrome CVE-2026-8520

EUVD-2026-30432 HIGH

Race Condition (CWE-362)

2026-05-14 Chrome

GHSA-jg93-pv2v-839r

Information Disclosure Google Race Condition

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Web-delivered (AV:N) with no auth (PR:N) but requires a page visit (UI:R) and winning a race (AC:H); sandbox escape crosses a trust boundary (S:C) with full impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.3 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:48 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's Payments component before 148.0.7778.168 lets a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox by winning a race condition. Rated Critical by Chromium and scored CVSS 8.3, it carries a scope-changing high-impact profile, though EPSS is a low 0.06% and there is no public exploit identified at time of analysis. A vendor patch is available and the flaw is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-362 (concurrent execution using a shared resource with improper synchronization, i.e., a race condition) inside Chrome's Payments subsystem, which handles the browser-side plumbing for the Payment Request/Payment Handler APIs. Because these operations coordinate state between the sandboxed renderer process and higher-privileged browser-process code, a timing window (time-of-check to time-of-use style) can allow memory or object state to be manipulated out from under a validating thread, corrupting assumptions the browser process relies on. Exploiting such a window against the process boundary is what enables escaping the renderer sandbox (reflected in the CVSS S:C scope change). The affected code is Chromium's desktop Chrome (cpe:2.3:a:google:chrome), and downstream rebuilds from Red Hat and SUSE inherit the same defect.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later (Stable Channel), per https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html; most users receive this automatically but should restart the browser to apply it, and enterprises pinning versions via policy must promote the fixed build. Red Hat and SUSE users should apply the corresponding chromium package updates from their distributions once published. No dedicated workaround is documented; if patching is delayed, compensating controls include using enterprise policy to restrict or disable the Payment Request/Payment Handler functionality (trade-off: breaks in-browser payment flows), enforcing site isolation and keeping the renderer sandbox enabled, and steering users away from untrusted pages via web filtering - none of these fully neutralize the race and updating is the only reliable fix.