What is the CVSS score of CVE-2026-8523?

CVE-2026-8523 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8523?

Google Chrome desktop has a sandbox escape vulnerability (CVE-2026-8523, CVSS 8.3) that could allow attackers to break out of browser isolation and access stored passwords and user data when…. A patch is available.

How to fix or mitigate CVE-2026-8523?

Within 24 hours, audit Chrome desktop deployments and identify systems running versions prior to 148.0.7778.168 using your endpoint management tools. Within 7 days, deploy Chrome version 148.0.7778.168 or later to all managed endpoints, prioritizing users with administrative privileges and those accessing external websites. By day 30, verify through compliance scans that 100% of Chrome instances have been updated and archive evidence of the patching campaign.

Google Chrome CVE-2026-8523

EUVD-2026-30438 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-937x-29v2-25x3

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a pre-compromised renderer (modeled as PR:L) and a race win (AC:H) with user interaction; sandbox breakout to the browser process gives S:C and total C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:45 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome desktop versions prior to 148.0.7778.168 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, abusing a use-after-free in the Mojo IPC layer. Rated High by Chromium and CVSS 8.3, it enables a scope change from the low-privilege renderer to the more-privileged browser process. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.07%), indicating no observed exploitation.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Mojo, Chromium's inter-process communication (IPC) framework that brokers messages between the sandboxed renderer processes and the higher-privilege browser process. Mojo message handling that frees an object while a reference remains reachable can allow an attacker in the renderer to reclaim and control freed memory, corrupting browser-process state across the IPC boundary. The affected component (cpe:2.3:a:google:chrome) is the Chrome desktop browser; because Mojo is the trust boundary between the sandbox and the privileged process, a UAF here is a classic sandbox-escape primitive rather than a mere in-renderer memory bug.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on all desktop platforms, as announced in the Chrome Stable channel update (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); Chrome normally auto-updates, so verify via chrome://settings/help and relaunch to apply. Chromium-based distributions from Red Hat and SUSE should be updated to their corresponding patched packages. Because exploitation requires a first-stage renderer compromise, interim risk can be reduced by keeping site isolation enabled (default) and ensuring users restart the browser so pending updates take effect; there is no supported feature toggle that removes the Mojo UAF without patching, so upgrading is the only reliable fix.