What is the CVSS score of CVE-2026-8552?

CVE-2026-8552 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8552?

Yes, a patch is available for CVE-2026-8552. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8552

EUVD-2026-30468 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-05-14 Chrome

GHSA-g2xv-4f6c-h6v9

Buffer Overflow Google Heap Overflow

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML (AV:N), user must load the page (UI:R), GPU sandbox contains impact to low integrity write (S:U, I:L), no credential or privilege requirement (PR:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:20 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

4.3 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

MEDIUM 4.3

DescriptionCVE.org

Heap buffer overflow in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in Chrome's GPU process on Android allows remote attackers to perform an out-of-bounds memory write by delivering a crafted HTML page, affecting all Chrome for Android versions prior to 148.0.7778.168. User interaction is required to trigger the vulnerability, and the assessed impact is limited to a partial integrity compromise within the browser's sandboxed GPU process. No public exploit code has been identified at time of analysis, EPSS sits at the 7th percentile, and CISA SSVC classifies exploitation as none - collectively indicating low near-term exploitation likelihood despite the network-facing attack vector.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) identifies the root cause: a heap-allocated GPU command buffer is written beyond its allocated boundary during HTML rendering on Android. Chrome employs a multi-process architecture in which the GPU process handles accelerated graphics operations; a malformed HTML page can issue GPU commands that exceed buffer bounds, corrupting adjacent heap memory. The vulnerability is confirmed Android-specific by both the CVE description and the EUVD record (EUVD-2026-30468), and the CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions, with the affected range bounded at 148.0.7778.168 per EUVD version data. The GPU process sandbox limits immediate impact, which is consistent with the CVSS scope-unchanged (S:U) rating.

RemediationAI

Update Google Chrome on Android to version 148.0.7778.168 or later; this is the vendor-released patch confirmed by the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. The update is delivered via the Google Play Store automatic update mechanism. As a compensating control prior to patching, restricting access to untrusted or externally-controlled web content - for example, by disabling JavaScript or browsing only to known-trusted sites - would reduce exposure, though this is impractical for general-purpose browsing use. Hardware-accelerated rendering cannot be disabled through a standard Chrome setting without developer tooling, limiting the viability of GPU-layer mitigations without the patch. No workaround fully substitutes for the vendor update.