What is the CVSS score of CVE-2026-8548?

CVE-2026-8548 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8548?

Google Chrome versions prior to 148.0.7778.168 contain a high-severity sandbox escape vulnerability (CVE-2026-8548) in the Media component that could enable attackers with renderer process access to…. A patch is available.

How to fix or mitigate CVE-2026-8548?

Within 24 hours, communicate the availability of Chrome version 148.0.7778.168 or later to all users and IT staff, highlighting the sandbox escape risk. Within 7 days, deploy the patch to all managed Chrome installations via your standard update process; for enterprise deployments, test in staging before full rollout. Within 30 days, verify patch completion across all systems using vulnerability scanning or Chrome version inventory, confirm all instances are running 148.0.7778.168 or later, and formally close this vulnerability in your tracking system.

Google Chrome CVE-2026-8548

EUVD-2026-30460 HIGH

Out-of-bounds Write (CWE-787)

2026-05-14 Chrome

GHSA-39w8-2393-mh75

Buffer Overflow Google Memory Corruption

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H captures the required prior renderer compromise, UI:R for loading the page, S:C for the sandbox escape crossing the renderer boundary, and full C/I/A impact on the browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:25 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Media component (versions prior to 148.0.7778.168) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. This is an out-of-bounds write (CWE-787) rated High by Chromium and CVSS 8.3, but exploitation is gated on chaining from a prior renderer compromise, and there is no public exploit identified at time of analysis. EPSS is very low (0.07%, 21st percentile) and CISA SSVC lists exploitation status as none.

Technical ContextAI

The flaw resides in Chrome's Media subsystem, which handles decoding and playback of audio/video content and is part of the renderer-facing attack surface exposed to web pages. The root cause is CWE-787 (Out-of-bounds Write): memory-corrupting logic writes past the bounds of an allocated buffer, which in a browser context can be leveraged to corrupt adjacent objects and gain control over execution. Because the Media code runs across the renderer/GPU boundary, a controlled OOB write here is valuable specifically as a second-stage primitive for escaping the renderer sandbox rather than for initial code execution. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies Google Chrome as the affected product across platforms; Red Hat and SUSE tags indicate the downstream Chromium/Chrome packages redistributed by those Linux vendors are also affected.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.168. Update Chrome to 148.0.7778.168 or later via the Stable channel update described at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html, then fully restart the browser so the new binary loads. On managed fleets, push the update through your enterprise Chrome management (or force-relaunch policy) to ensure the restart actually happens. Red Hat and SUSE users should apply the corresponding distribution errata for their Chromium/Chrome packages once published. If immediate patching is not possible, reduce exposure by restricting untrusted web browsing and using site isolation and OS-level sandboxing (both on by default in Chrome) - these do not fix the bug but raise the bar for the required prior renderer compromise; disabling hardware/media acceleration is not a reliable mitigation and is not a substitute for the update.