What is the CVSS score of CVE-2026-8539?

CVE-2026-8539 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8539?

Yes, a patch is available for CVE-2026-8539. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8539

EUVD-2026-30451 MEDIUM

Code Injection (CWE-94)

2026-05-14 Chrome

GHSA-j475-f95x-5chm

RCE Google Code Injection

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

UXSS breaks same-origin policy across origins (S:C); no privileges needed, but active user visit required (UI:R); no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

MEDIUM

qualitative

Red Hat

8.1 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:28 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

5.4 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

MEDIUM 5.4

DescriptionCVE.org

Script injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Script injection in Google Chrome's SanitizerAPI on Android (versions prior to 148.0.7778.168) enables Universal Cross-Site Scripting (UXSS), allowing unauthenticated remote attackers to bypass same-origin policy protections via a crafted HTML page when visited by a victim. The Sanitizer API - ironically a defensive web platform feature designed to strip dangerous markup - contains a code injection flaw that permits injected scripts or HTML to survive sanitization. No active exploitation has been confirmed (not in CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC classifies exploitation as none; however, the UXSS impact class warrants prompt patching given Chrome's ubiquitous deployment footprint.

Technical ContextAI

The Sanitizer API (SanitizerAPI) is a modern browser API providing a programmatic interface for safe HTML sanitization, intended to prevent XSS by removing dangerous markup before injection into the DOM. CWE-94 (Improper Control of Generation of Code / Code Injection) identifies the root cause as failure to properly neutralize user-controlled input within the sanitizer's parsing pipeline on Android. The vulnerability is platform-specific to Android Chrome, suggesting the Android rendering path or native bridge handling diverges from desktop behavior in a way that permits script bypass. UXSS is a particularly severe XSS class because it affects not just the vulnerable page's origin but potentially any origin the browser communicates with, breaking the same-origin policy. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions below the patched threshold on Android.

RemediationAI

The primary remediation is updating Google Chrome on Android to version 148.0.7778.168 or later. The patch was released via the stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Users should enable automatic updates or manually trigger an update via the Chrome menu on Android. Organizations managing Android fleets via MDM should push the update through their device management platform and verify version compliance. If immediate patching is not feasible, a compensating control is to restrict user navigation to trusted domains via enterprise policy (BrowserAllowList or URLBlocklist) - note this significantly limits browser utility. Disabling JavaScript globally would prevent exploitation but breaks virtually all web functionality. There is no configuration-level toggle for the SanitizerAPI itself in standard Chrome deployments.