What is the CVSS score of CVE-2026-8524?

CVE-2026-8524 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8524?

Google Chrome versions before 148.0.7778.168 contain a code execution vulnerability in the WebAudio component affecting all organization users.. A patch is available.

How to fix or mitigate CVE-2026-8524?

Within 24 hours, verify Chrome auto-update infrastructure is operational and identify systems requiring manual patching (air-gapped or heavily restricted endpoints). Within 7 days, deploy Chrome 148.0.7778.168 or later across all user devices, prioritizing machines handling financial systems, customer data, or intellectual property. Within 30 days, audit endpoint telemetry to confirm Chrome version compliance organization-wide and escalate any remaining unpatched systems for immediate remediation.

Google Chrome CVE-2026-8524

EUVD-2026-30436 HIGH

Out-of-bounds Write (CWE-787)

2026-05-14 Chrome

GHSA-r4p4-x45m-mwxq

RCE Buffer Overflow Google Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges but requires the victim to open it (UI:R); memory-corruption RCE gives high C/I/A, but scope stays unchanged as execution is confined to the renderer sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:44 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds write in Google Chrome's WebAudio component (versions prior to 148.0.7778.168) lets a remote attacker achieve arbitrary code execution within the renderer sandbox when a victim opens a crafted HTML page. Google rates the Chromium severity as High and has shipped a fixed Stable channel build; there is no public exploit identified at time of analysis and the EPSS score is very low (0.07%). Because execution is confined to the sandbox, real-world impact typically requires chaining a separate sandbox-escape bug.

Technical ContextAI

The flaw is a CWE-787 out-of-bounds write in WebAudio, the Web Audio API implementation that lets pages synthesize, process, and route audio through a graph of audio nodes running inside the renderer process. Malformed audio-processing parameters or buffer sizing in this native C++ code path allow writes past the bounds of an allocated buffer, corrupting adjacent heap memory. The affected CPE is cpe:2.3:a:google:chrome (Chromium-based), so the same underlying WebAudio code affects downstream Chromium builds; Red Hat and SUSE tags indicate Linux distributions repackaging Chromium/Chrome are also in scope. Memory-corruption primitives of this class are a well-known route to control of program flow and code execution.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later via the Stable channel and relaunch the browser to apply it, per the Chrome release advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. For managed fleets, push the updated build through your enterprise update mechanism and confirm relaunch, since the fix only takes effect after restart. Red Hat and SUSE users should pull the corresponding distribution package once rebased on the fixed Chromium. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites and, where feasible, disabling the Web Audio API surface via policy or content controls to remove the vulnerable code path - note this will break legitimate audio-processing web applications (conferencing, games, media tools).