What is the CVSS score of CVE-2026-8551?

CVE-2026-8551 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8551?

Google Chrome desktop installations are vulnerable to remote code execution through a Downloads component flaw that requires user interaction with a crafted webpage.. A patch is available.

How to fix or mitigate CVE-2026-8551?

Within 24 hours, enable Chrome's automatic update feature organization-wide and manually deploy Chrome version 148.0.7778.168 to systems handling sensitive information. Within 7 days, complete enterprise-wide deployment using your device management solution (Group Policy for Windows, Intune, or Workspace ONE), targeting 100% remediation of all Chrome instances. Within 30 days, audit endpoint telemetry for suspicious download and execution activity during the pre-patch window, and reinforce user security awareness training on risks of executing files from untrusted sources.

Google Chrome CVE-2026-8551

EUVD-2026-30463 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-v77q-jqj8-8vvq

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page with no privileges (AV:N/PR:N) but mandatory user download-UI interaction (UI:R); a UAF yielding code execution gives full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:20 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop before 148.0.7778.168 stems from a use-after-free (CWE-416) in the Downloads component, letting a remote attacker who lures a victim into performing specific UI interactions run arbitrary code via a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw was reported internally by the Chrome team and is patched in the Stable channel update. No public exploit identified at time of analysis, and EPSS is low at 0.08%.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) in Chrome's Downloads subsystem, part of the Blink/Chromium rendering and browser-process download-handling code that manages download items, their UI shelf/prompts, and lifecycle. A use-after-free arises when a heap object (here a download-related object) is freed while a dangling pointer to it remains reachable; subsequent dereference of that stale pointer during specific download-related UI gestures can be manipulated to corrupt memory and hijack control flow. The single affected CPE is cpe:2.3:a:google:chrome, and because Chromium is the upstream engine, downstream Chromium-based browsers and OS vendor packages (Red Hat, SUSE per the tags) rebase and ship the same fix.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on all desktop platforms via the Chrome Releases Stable channel update (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); Chrome's built-in updater applies this automatically, so verify at chrome://settings/help and relaunch to complete the update. Downstream Chromium-based browsers and Linux packages should be updated to the vendor build incorporating the fixed Chromium (Red Hat and SUSE ship corresponding errata). No standalone configuration workaround fully mitigates a use-after-free; as an interim compensating control, enterprises can enforce automatic browser updates via policy and instruct users to avoid interacting with unexpected download prompts on untrusted pages, accepting that this is user-dependent and not a reliable substitute for patching. Reference tracking: https://issues.chromium.org/issues/498376171.