What is the CVSS score of CVE-2026-8533?

CVE-2026-8533 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8533?

Google Chrome before version 148.0.7778.168 contains a sandbox escape vulnerability that, if exploited after a browser compromise, could allow attackers to gain unrestricted access to the operating…. A patch is available.

How to fix or mitigate CVE-2026-8533?

Within 24 hours, notify all Chrome users of the mandatory update requirement due to a high-severity sandbox escape. Within 7 days, deploy Chrome 148.0.7778.168 or later enterprise-wide through automated update policies and patch management systems. Within 30 days, complete deployment verification confirming 100% of managed Chrome instances are at version 148.0.7778.168 or later and audit for unmanaged instances.

Google Chrome CVE-2026-8533

EUVD-2026-30445 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-6gfv-c8p2-h6xg

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R reflect the required renderer-compromise precondition and user navigation; S:C and C/I/A:H capture a full sandbox escape into the browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:30 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome desktop before 148.0.7778.168 lets a remote attacker who has already compromised the renderer process break out of the sandbox by triggering a use-after-free in the Accessibility component via a crafted HTML page. Rated High by Chromium and scored CVSS 8.3, it is a second-stage exploit primitive rather than a standalone remote break-in. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 21st percentile), consistent with the SSVC exploitation status of 'none'.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Accessibility (a11y) subsystem, the browser-process code that exposes the accessibility tree to assistive technologies and receives updates from renderer processes. Because the accessibility tree is populated from renderer-supplied data that crosses the sandbox boundary into the higher-privileged browser process, a dangling pointer freed then reused during a11y object lifecycle handling can be manipulated by a malicious renderer to corrupt browser-process memory. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms Chrome itself (Blink/Chromium engine) as the affected product; downstream rebuilds (Red Hat, SUSE per tags) inherit the same Chromium code. Use-after-free bugs of this class are the classic vehicle for converting renderer-level code execution into browser-process (out-of-sandbox) execution.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later (desktop stable channel), per Google's advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html; Chrome's built-in updater will apply this on relaunch, so ensure users restart the browser to complete installation. For managed fleets, push the updated version via enterprise policy and verify the effective version. Chromium-derived products (Red Hat, SUSE, and other Chromium-based browsers) should install their vendor's rebuild containing the equivalent fix. As an interim compensating control where patching is delayed, reduce exposure to attacker-controlled web content by restricting browsing to trusted sites and enabling site isolation and enhanced sandbox protections (Chrome's Site Isolation is on by default and raises the bar for the required renderer compromise); note this does not eliminate the bug and only limits the likelihood of a full chain. Track the Chromium issue at https://issues.chromium.org/issues/495247950 for further detail.