What is the CVSS score of CVE-2026-8536?

CVE-2026-8536 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8536?

Yes, a patch is available for CVE-2026-8536. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8536

EUVD-2026-30448 LOW

Improper Input Validation (CWE-20)

2026-05-14 Chrome

GHSA-95f7-hw38-qq42

Google Authentication Bypass Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:24 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

3.1 (None) 3.1 (LOW)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass site Isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site Isolation bypass in Google Chrome on macOS allows attackers who have already compromised the renderer process to leak limited cross-origin data via malicious HTML in ReadingMode. Affects Chrome versions prior to 148.0.7778.168 on Mac only. EPSS score of 0.02% (6th percentile) indicates very low predicted exploitation probability. No active exploitation detected (not in CISA KEV), no public POC identified. CVSS 3.1 assigns Low severity despite High vendor severity rating due to requiring both renderer compromise and user interaction, with impact limited to confidentiality only.

Technical ContextAI

Site Isolation is Chrome's critical security architecture that separates different origins into distinct renderer processes to prevent Spectre-class attacks and cross-site data leakage. This vulnerability affects the ReadingMode feature specifically on macOS Chrome builds. CWE-20 (Insufficient Input Validation) indicates the ReadingMode component failed to properly sanitize untrusted input when rendering simplified page views. The flaw allows an attacker who has already achieved renderer process compromise-typically through a separate vulnerability or chain-to violate Site Isolation boundaries and access limited cross-origin information. The platform-specific nature (Mac only) suggests the vulnerability lies in macOS-specific ReadingMode implementation code rather than cross-platform Chromium rendering logic.

RemediationAI

Update Google Chrome on macOS to version 148.0.7778.168 or later immediately via Chrome's built-in updater (Settings → About Chrome) or download from https://www.google.com/chrome/. Chrome typically auto-updates within 24-48 hours of release for most users. For enterprise deployments using managed Chrome policies, push version 148.0.7778.168 via your update management system and verify deployment completion using chrome://policy and chrome://version endpoints. No effective workarounds exist since disabling ReadingMode is not exposed as a configurable policy, and the feature is integrated into core browsing functionality. Compensating controls are not practical-patching is the only viable remediation. Official vendor advisory with release notes: http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html and Chromium bug tracker: https://issues.chromium.org/issues/495857582.