What is the CVSS score of CVE-2026-8554?

CVE-2026-8554 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8554?

Yes, a patch is available for CVE-2026-8554. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8554

EUVD-2026-30466 LOW

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-05-14 Chrome

GHSA-wq6f-gfjm-68cq

Google Microsoft Information Disclosure Memory Corruption Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:24 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

3.1 (None) 3.1 (LOW)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Type Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds memory write in Google Chrome's ANGLE graphics library (Windows only) enables attackers who have already compromised the renderer process to corrupt memory via specially crafted HTML pages. Chrome 148.0.7778.168 patches this type confusion vulnerability. Despite high Chromium severity rating, CVSS 3.1 scores only 3.1 due to prerequisite renderer compromise, high attack complexity, and required user interaction. EPSS 0.03% (10th percentile) and SSVC indicating no known exploitation suggest limited real-world risk at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's OpenGL ES implementation built atop Direct3D on Windows, translating WebGL calls for GPU rendering. The vulnerability stems from CWE-843 type confusion, where the code incorrectly handles object types during memory operations in the graphics pipeline. Type confusion occurs when code assumes data is one type when it's actually another, bypassing type safety checks. In memory-unsafe languages like C++, this can corrupt memory layout and enable out-of-bounds writes. The Windows-specific nature indicates the flaw resides in ANGLE's Direct3D backend rather than cross-platform OpenGL code. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms Google Chrome as the affected product, with ANGLE being a bundled component rather than separate software requiring independent patching.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.168 or later, available through Chrome's built-in auto-update mechanism (three-dot menu → Help → About Google Chrome) or manual download from google.com/chrome. The May 2026 Stable Channel Update (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html) contains the fix. Enterprise deployments should push version 148.0.7778.168+ via GPO or endpoint management tools. No workarounds exist for this ANGLE component vulnerability short of disabling WebGL entirely (chrome://flags/#disable-webgl), which breaks legitimate web applications relying on hardware-accelerated 3D graphics and is not recommended for general use. Organizations unable to immediately patch should prioritize defense-in-depth controls: restrict browsing to trusted sites via proxy whitelisting, deploy browser isolation technology to contain renderer process exploits, and enable Chrome's Enhanced Safe Browsing mode to detect exploit delivery attempts. Note that disabling JavaScript would prevent exploitation but renders most modern websites unusable.