What is the CVSS score of CVE-2026-8528?

CVE-2026-8528 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8528?

Yes, a patch is available for CVE-2026-8528. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8528

EUVD-2026-30444 MEDIUM

Improper Input Validation (CWE-20)

2026-05-14 Chrome

GHSA-x43m-gvp6-h6mf

Google Authentication Bypass Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.9 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 16:22 vuln.today

CVSS changed

May 15, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass Site Isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site Isolation bypass in Google Chrome versions prior to 148.0.7778.168 enables attackers who have already compromised the renderer process to break out of security sandboxes via specially crafted HTML pages. This represents an escalation path within Chrome's multi-process architecture, allowing cross-origin data access after initial renderer compromise. Vendor patch available as of May 2026 stable channel update. EPSS score of 0.02% (6th percentile) indicates minimal observed exploitation activity, and no CISA KEV listing or public POC exists at time of analysis, suggesting lower immediate priority despite the architectural significance of Site Isolation failures.

Technical ContextAI

Site Isolation is Chrome's core security architecture that runs each website origin in separate processes to prevent cross-site data leakage (Spectre/Meltdown mitigation). This vulnerability stems from insufficient input validation (CWE-20) in the Site Isolation implementation, allowing malicious HTML to manipulate process boundaries. The attack requires pre-compromise of Chrome's renderer process - the sandboxed component responsible for parsing web content. Renderer compromise typically occurs through separate vulnerabilities like memory corruption bugs (use-after-free, buffer overflows). CPE cpe:2.3:a:google:chrome identifies all Chrome versions prior to 148.0.7778.168 as affected across Windows, macOS, Linux, and ChromeOS platforms. This represents a second-stage exploit in Chrome's defense-in-depth model, where the attacker has already broken the first sandbox layer but needs to defeat Site Isolation to access sensitive cross-origin data.

RemediationAI

Update Google Chrome to version 148.0.7778.168 or later immediately via Chrome's built-in updater (Settings → About Chrome) or deploy the stable channel update from chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html through enterprise management tools. Chrome typically auto-updates within 24-48 hours for consumer users; enterprise deployments should prioritize manual push to managed fleets. No workaround exists for this architectural vulnerability - mitigation requires the patched Chrome binary. Compensating controls have limited value since the prerequisite renderer compromise already represents significant security failure, but defense-in-depth measures include: enforcing Chrome Enterprise policies to disable high-risk features like WebUSB/WebBluetooth (reduces renderer attack surface but does not address this specific vulnerability), implementing network segmentation to limit post-exploitation lateral movement (reduces impact after successful Site Isolation bypass), and deploying endpoint detection to identify anomalous renderer process behavior (may detect the prerequisite compromise). Note these compensating controls address the broader attack chain, not this specific bypass, and introduce operational complexity without eliminating risk.