What is the CVSS score of CVE-2026-8537?

CVE-2026-8537 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8537?

Yes, a patch is available for CVE-2026-8537. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8537

EUVD-2026-30453 MEDIUM

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-05-14 Chrome

GHSA-j274-v69m-27gh

Information Disclosure Chrome Google Red Hat Cors Misconfiguration Suse

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:24 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Google Chrome versions prior to 148.0.7778.168 leak cross-origin data through insufficient policy enforcement in the ViewTransitions API when users interact with specially crafted HTML pages. The vulnerability enables remote attackers to bypass same-origin policy protections and extract sensitive information from other origins without authentication, though exploitation requires user interaction (clicking a link or visiting a malicious page). With EPSS at 0.03% (10th percentile) and no confirmed active exploitation, this represents a moderate information disclosure risk primarily affecting organizations where targeted phishing could deliver malicious pages to Chrome users.

Technical ContextAI

The View Transitions API is a modern web platform feature in Chrome that enables smooth visual transitions between different page states or navigation events. This vulnerability stems from CWE-942 (Permissive Cross-domain Policy with Untrusted Domains), indicating the browser failed to properly enforce same-origin policy boundaries during view transition rendering or state management. When ViewTransitions processes visual snapshots or DOM state between origins, insufficient validation allows cross-origin information to leak through timing channels, rendered content, or API responses. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) confirms this impacts the core Chrome browser application across all platforms (Windows, macOS, Linux, ChromeOS) running versions below the patched 148.0.7778.168 release.

RemediationAI

Update Google Chrome to version 148.0.7778.168 or later immediately via the built-in updater (chrome://settings/help) or download from https://www.google.com/chrome. Chrome's auto-update mechanism deploys this patch automatically within 2-7 days for most users. For enterprise environments using managed Chrome deployments, push version 148.0.7778.168 through group policy or mobile device management systems. Organizations unable to patch immediately should implement compensating controls: configure Chrome Enterprise Policy to disable Experimental Web Platform Features (chrome://flags/#enable-experimental-web-platform-features set to Disabled) which may restrict ViewTransitions API availability, though this breaks legitimate sites using the feature and may impact user experience. Deploy browser isolation solutions (remote browser isolation or sandboxing) for high-risk users accessing untrusted content. Network-level defenses (firewalls, proxies) cannot mitigate this client-side vulnerability. Chromium-based browser vendors should verify they have incorporated the fix from https://issues.chromium.org/issues/495890000 into their builds. No server-side mitigations exist as exploitation occurs entirely in the victim's browser.