What is the CVSS score of CVE-2026-8529?

CVE-2026-8529 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8529?

Google Chrome versions prior to 148.0.7778.168 contain a heap buffer overflow in media processing that could enable remote code execution when employees view crafted video files, creating endpoint…. A patch is available.

How to fix or mitigate CVE-2026-8529?

Within 24 hours, distribute notification of Chrome 148.0.7778.168 patch availability and verify automatic update mechanisms are enabled across managed endpoints. Within 7 days, deploy Chrome 148.0.7778.168 or later to all enterprise Chrome installations using your endpoint management platform, prioritizing business-critical systems and monitoring completion rates. By day 30, audit all Chrome installations to confirm version compliance and document any systems unable to auto-update, establishing a remediation plan for legacy or air-gapped endpoints.

Google Chrome CVE-2026-8529

EUVD-2026-30443 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-14 Chrome

GHSA-9g6r-32x9-xm98

RCE Buffer Overflow Google Heap Overflow

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable crafted media with low complexity and no auth, but requires the victim to open the file (UI:R); impact high yet scope-unchanged (S:U) since code stays in the sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:42 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop prior to 148.0.7778.168 stems from a heap buffer overflow in the browser's media Codecs component, allowing a remote attacker to run arbitrary code within the renderer sandbox when a victim processes a crafted video file. Reported internally by the Chrome team and rated High severity by Chromium, it carries CVSS 8.8 but requires user interaction (UI:R). There is no public exploit identified at time of analysis, and EPSS is low at 0.07%.

Technical ContextAI

The flaw is a CWE-122 heap-based buffer overflow inside Chrome's Codecs (media decoding) subsystem, which parses and decodes untrusted audio/video streams. Malformed dimensions or frame metadata in a crafted video file can cause the decoder to write beyond an allocated heap buffer, corrupting adjacent heap structures and enabling control-flow hijack. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome application across platforms. Notably the description states execution occurs 'inside a sandbox,' meaning the initial corruption lands in a sandboxed renderer process rather than achieving direct host compromise, and would still require a separate sandbox-escape to reach the OS.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.168 - upgrade to 148.0.7778.168 or later on all desktop platforms, then fully restart the browser so the new version loads (Chrome auto-updates but the fix does not apply until relaunch). Downstream Chromium-based packages from Red Hat and SUSE should be updated to their corresponding fixed builds as they publish. As an interim compensating control before patching, restrict or disable automatic playback/rendering of untrusted media and avoid opening video files or pages from untrusted sources; enterprises can enforce update policies via group policy/MDM to guarantee the relaunch. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html and the Chromium issue https://issues.chromium.org/issues/490222151 for tracking.