What is the CVSS score of CVE-2026-8540?

CVE-2026-8540 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8540?

A remote code execution vulnerability in Google Chrome's V8 engine (CVE-2026-8540, CVSS 8.8) could allow attackers to execute arbitrary code in the browser sandbox when users visit a malicious…. A patch is available.

How to fix or mitigate CVE-2026-8540?

Within 24 hours, identify Chrome versions deployed across your managed systems and alert users to avoid suspicious websites pending patching. Within 7 days, deploy Google Chrome version 148.0.7778.168 or later through your standard patch management infrastructure, prioritizing business-critical systems and user-facing devices. Within 30 days, validate patch adoption across all systems and maintain monitoring for security incidents related to this vulnerability.

Google Chrome CVE-2026-8540

EUVD-2026-30454 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-05-14 Chrome

GHSA-7w4v-j6pr-v8hv

RCE Google Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges but requires the user to visit it (UI:R); code executes within the unchanged renderer sandbox (S:U) with total impact on that component.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:27 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine before 148.0.7778.168 allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw is a type confusion bug and requires user interaction (visiting a malicious page); no public exploit identified at time of analysis and EPSS probability is very low (0.08%). Google has shipped a patched Stable channel release.

Technical ContextAI

The vulnerability resides in V8, the C++ JavaScript and WebAssembly engine that powers Chrome and Chromium-based browsers. CWE-843 (Type Confusion) means the engine operates on an object while assuming it is of a different type than it actually is, typically arising from V8's speculative optimizations (JIT) or object-shape/map assumptions being violated. When the engine reinterprets memory under an incorrect type, an attacker can gain out-of-bounds read/write primitives that lead to controlled memory corruption and, ultimately, arbitrary code execution inside the renderer process. The affected component is the Chrome browser application per CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*; because V8 is shared, Chromium-derived browsers may carry the same defect until they pick up the fix.

RemediationAI

Vendor-released patch: 148.0.7778.168 - update Google Chrome to 148.0.7778.168 or later via the Chrome Releases Stable channel advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html) and restart the browser to apply the update, since Chrome auto-updates only take effect on relaunch. Enterprises managing Chromium-based or vendor-repackaged builds (e.g., Red Hat, SUSE) should track and deploy their distributor's corresponding fixed package. If immediate patching is not possible, reduce exposure by enabling Site Isolation (default in Chrome) and restricting users from browsing untrusted sites, and consider enforcing JavaScript restrictions on high-risk profiles via enterprise policy - with the trade-off that disabling JavaScript broadly breaks most modern web applications and is impractical as a long-term control. The durable fix is upgrading; workarounds are stopgaps only.