What is the CVSS score of CVE-2026-8532?

CVE-2026-8532 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8532?

Google Chrome desktop versions prior to 148.0.7778.168 contain a remote code execution vulnerability in the browser sandbox (CVE-2026-8532) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-8532?

Within 24 hours: Inventory all Chrome desktop versions in your environment and notify users of the available security update. Within 7 days: Deploy Chrome 148.0.7778.168 or later enterprise-wide using your standard software distribution process, prioritizing systems used by financial, operations, and executive teams. Within 30 days: Verify deployment completion across all managed endpoints, confirm patched version compliance through EDR or asset management systems, and review security logs for any exploitation attempts related to this vulnerability.

Google Chrome CVE-2026-8532

EUVD-2026-30446 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-14 Chrome

GHSA-phr6-cg52-w545

RCE Google

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page reachable without auth (AV:N/PR:N) but needs victim to visit (UI:R); sandboxed RCE gives high C/I/A with no scope change (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:30 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed remote code execution in Google Chrome desktop versions prior to 148.0.7778.168 allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw stems from an integer overflow in Chrome's XML handling and is rated High by Chromium; it requires user interaction (visiting a malicious page) and carries no public exploit identified at time of analysis, with a low EPSS of 0.08%.

Technical ContextAI

The vulnerability lives in Chrome's XML processing path, where an arithmetic integer overflow corrupts size or index calculations, leading to memory unsafety exploitable for code execution. The CWE is reported as CWE-472 (External Control of Assumed-Immutable Web Parameter), which does not align cleanly with the 'integer overflow' language in the description - integer overflow is normally CWE-190 - so the root-cause classification appears mislabeled and should be treated with caution. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the Google Chrome desktop application (Blink/Chromium engine) as the affected component; because the code executes 'inside a sandbox,' the immediate impact is confined to the renderer process rather than the host OS, absent a separate sandbox-escape chain.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later via the Stable channel, then fully restart the browser to apply the update (see https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html). Enterprises managing Chrome via policy should push the updated build through their deployment tooling and verify version compliance, and downstream users on Red Hat or SUSE should install the corresponding vendor-repackaged Chromium updates. If patching cannot happen immediately, reduce exposure by restricting browsing to trusted sites, deploying URL/content filtering to block untrusted HTML, and - where feasible - enabling stricter site isolation and disabling access to attacker-controlled pages, accepting the trade-off that these controls degrade user browsing flexibility and do not fully close the flaw.