What is the CVSS score of CVE-2026-8545?

CVE-2026-8545 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8545?

Yes, a patch is available for CVE-2026-8545. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8545

EUVD-2026-30457 LOW

Improper Access Control (CWE-284)

2026-05-14 Chrome

GHSA-6637-whm9-6p45

Google Authentication Bypass Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:24 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

3.1 (None) 3.1 (LOW)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome versions prior to 148.0.7778.168 occurs when an attacker who has already compromised the renderer process exploits an object corruption flaw in the Compositing component. The vulnerability requires user interaction with a malicious HTML page and high attack complexity to leak sensitive cross-origin data. Google has released a patch in Chrome 148.0.7778.168, and with EPSS at 0.03% (10th percentile) and no evidence of active exploitation (SSVC: none), this represents a medium-priority targeted threat rather than widespread exploitation risk.

Technical ContextAI

This vulnerability affects the Compositing component of Google Chrome's rendering engine, which manages how web page layers are combined and displayed. The flaw is categorized as CWE-284 (Improper Access Control), indicating insufficient enforcement of security boundaries between different origins. The Compositing system in Chromium-based browsers handles hardware-accelerated rendering and layer management, and corruption in this component can bypass same-origin policy protections. According to the CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, all Chrome versions prior to the patched release are affected. The vulnerability requires a compromised renderer process as a precondition, meaning it serves as a second-stage exploit in a browser escape chain rather than an initial access vector. The improper access control allows memory objects from one origin to be accessed from another origin context, violating fundamental web security principles.

RemediationAI

Update Google Chrome to version 148.0.7778.168 or later immediately through the browser's built-in update mechanism (Settings > About Chrome) or by downloading the latest version from google.com/chrome. Chrome typically auto-updates within 24-48 hours of release, but manual updates ensure immediate protection. Enterprise administrators should deploy the patch through their standard Chrome update channels (Google Update/MSI packages for Windows, PKG for macOS, or package managers for Linux). The official advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html confirms patch availability. For organizations unable to patch immediately, implement defense-in-depth controls: enable Site Isolation (chrome://flags/#site-isolation-trial-opt-out set to Default or Enabled) to strengthen origin separation and limit cross-origin data access even if Compositing is compromised; deploy browser isolation technologies (remote browser isolation or virtualized browsing) for high-risk users accessing untrusted content; restrict Chrome usage to trusted sites only until patched using enterprise policies like URLBlocklist/URLAllowlist. Note that Site Isolation increases memory usage by approximately 10-13% and may impact performance on low-resource systems. These mitigations reduce but do not eliminate risk since the vulnerability requires prior renderer compromise, making layered defenses critical.