What is the CVSS score of CVE-2026-8530?

CVE-2026-8530 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8530?

A high-severity sandbox escape in Chrome on Windows (versions before 148.0.7778.168) allows attackers with initial browser access to break out of security isolation and achieve complete system…. A patch is available.

How to fix or mitigate CVE-2026-8530?

Within 24 hours, identify all Windows systems with Chrome installed and assess critical systems requiring prioritized patching. Within 7 days, deploy Chrome version 148.0.7778.168 to all Windows endpoints-prioritize systems supporting critical business functions and high-risk user roles. Enforce installation via Group Policy or mobile device management where available, and communicate the patch timeline to users. Within 30 days, verify 100% deployment completion and conduct an enterprise-wide Chrome version audit to ensure no systems remain on vulnerable versions prior to 148.0.7778.168.

Google Chrome CVE-2026-8530

EUVD-2026-30442 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-wwp9-cf2c-qh88

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H for heap-grooming plus the compromised-renderer precondition, UI:R for loading the crafted page, S:C and C/I/A:H because escaping the sandbox crosses into the higher-privileged browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:42 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows before 148.0.7778.168 lets an attacker who already controls a compromised renderer process break out of the browser sandbox by triggering a use-after-free in the Network component via a crafted HTML page. It is a second-stage bug that chains onto a prior renderer compromise rather than a standalone entry point, carrying High Chromium severity and CVSS 8.3. There is no public exploit identified at time of analysis, and EPSS is very low at 0.07% (21st percentile).

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Network service, the process/component that handles URL loading, sockets, cache, and cross-origin fetch logic underpinning Chromium's multi-process security model. A use-after-free arises when memory is freed while a dangling reference remains reachable; an attacker who grooms the heap can cause the freed object to be reallocated with controlled data and then dereferenced, yielding memory corruption and potential control-flow hijack. Because the Network service straddles the boundary between the sandboxed renderer and higher-privileged browser plumbing, corrupting its state is a classic path for sandbox escape. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with the fix landing in the Chrome stable channel at 148.0.7778.168 (Chromium issue 491930142).

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on Windows via the stable channel (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); restart the browser to ensure the update is applied since Chrome patches only take effect after relaunch. Enterprises managing Chrome via policy should push the updated build and force relaunch. No patch-free workaround fully removes the bug, but because exploitation requires a compromised renderer first, hardening against the renderer-compromise stage helps: keep Site Isolation enabled (default), avoid disabling the sandbox, and consider restricting untrusted browsing - the trade-off being user friction. Downstream users on Red Hat or SUSE Chromium packages should apply their distributor's corresponding update.