What is the CVSS score of CVE-2026-8525?

CVE-2026-8525 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8525?

Google Chrome for macOS versions before 148.0.7778.168 contain a heap buffer overflow enabling sandbox escape attacks that could grant attackers elevated privileges on user systems.. A patch is available.

How to fix or mitigate CVE-2026-8525?

Within 24 hours, notify all macOS users and IT administrators that Chrome requires urgent security patching to version 148.0.7778.168 or later; ensure automatic updates are enabled for centrally managed Chrome deployments. By day 7, verify patching completion on all macOS endpoints using native Chrome update mechanisms or endpoint management tools. By day 30, audit Chrome version compliance across all macOS workstations to confirm 100% adoption of the patched version, document the remediation timeline, and maintain records for compliance reporting.

Google Chrome CVE-2026-8525

EUVD-2026-30441 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-14 Chrome

GHSA-ghgw-c29j-38q7

Buffer Overflow Google Heap Overflow

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote crafted page needs no auth (PR:N) but requires a victim visit (UI:R) and reliable heap grooming (AC:H); sandbox escape crosses a trust boundary (S:C) with total impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:44 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for macOS before 148.0.7778.168 stems from a heap buffer overflow in the ANGLE graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and cross into a higher-privilege context. Google rates the Chromium severity High and a fixed build is available, but there is no public exploit identified at time of analysis. EPSS is very low (0.06%) and CISA SSVC records exploitation status as none, indicating no observed attacks.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform translation layer that maps WebGL/OpenGL ES calls onto native backends (Metal on macOS), so it processes attacker-influenceable geometry, shader, and texture data originating from web content. The flaw is CWE-122, a heap-based buffer overflow, meaning a memory allocation on the heap is written past its bounds; in a GPU-adjacent component this corruption can be leveraged to manipulate control data or object metadata. Because ANGLE straddles the boundary between the sandboxed renderer and the more privileged GPU process, memory corruption here is what makes a sandbox escape plausible, consistent with the CVSS scope-change (S:C) rating. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome application itself, with the description narrowing impact specifically to the macOS build.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.168 for macOS - upgrade to this build or later via Chrome's automatic update mechanism and relaunch the browser to apply it (check chrome://settings/help to force the update and confirm the version). No practical in-product workaround preserves normal functionality for an ANGLE/GPU rendering flaw; if patching must be delayed on managed fleets, the only meaningful compensating control is to reduce exposure to untrusted web content, and enterprises could enforce the update through policy. Disabling GPU/hardware acceleration or WebGL may reduce ANGLE's attack surface but degrades rendering performance and breaks WebGL-dependent sites, so it is a poor trade-off versus simply updating. Refer to the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html) and vuldb.com/vuln/364022 for tracking.