What is the CVSS score of CVE-2026-8522?

CVE-2026-8522 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8522?

Google Chrome on macOS versions prior to 148.0.7778.168 contains a critical use-after-free vulnerability in the Downloads component enabling remote code execution when users visit crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-8522?

Within 24 hours, inventory all macOS systems and identify Chrome installations running versions before 148.0.7778.168; confirm your endpoint update configuration supports automatic patching. Within 7 days, push Google Chrome version 148.0.7778.168 or later to 100% of macOS endpoints through your MDM or browser auto-update mechanism. Within 30 days, verify patch compliance through endpoint scanning, document the completion, and archive evidence for audit compliance.

Google Chrome CVE-2026-8522

EUVD-2026-30434 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-j89q-h74w-5c2q

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remotely reachable low-complexity UAF needing no privileges but requiring the victim to visit a crafted page (UI:R); full C/I/A impact from arbitrary code execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:46 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to 148.0.7778.168 stems from a use-after-free in the Downloads component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the browser process. Rated Critical by Chromium and CVSS 8.8, it requires user interaction (visiting the page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.08%), consistent with SSVC exploitation status of 'none'.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Downloads subsystem, the component that manages download requests, prompts, and file handling within the browser. A use-after-free occurs when memory is freed but a dangling pointer is later dereferenced, allowing an attacker who controls heap allocation to reclaim that memory and steer execution. The affected product per CPE is cpe:2.3:a:google:chrome (all versions before the fix) specifically on the macOS platform per the description. Because Downloads processing can be driven by content served from an attacker-controlled page, malicious HTML/JavaScript can orchestrate the allocation and freeing sequence needed to trigger the condition.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on macOS via the Chrome Stable channel (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); restart the browser to complete the update since Chrome applies fixes on relaunch. Enterprises managing Chrome via policy should confirm auto-update is enabled and push the minimum version, and users of Chromium-based redistributions from Red Hat or SUSE should apply their respective vendor package updates as they become available. If patching must be delayed, reduce exposure by restricting browsing to trusted sites, deploying Chrome's Enhanced Safe Browsing, and using site isolation and OS-level sandboxing (default on macOS) to contain a compromised renderer - these lower but do not eliminate risk, and browsing restrictions carry usability trade-offs.