What is the CVSS score of CVE-2026-8555?

CVE-2026-8555 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8555?

A critical vulnerability in Google Chrome on Windows (CVE-2026-8555, CVSS 8.8) allows remote code execution through malicious webpages, potentially compromising systems when users browse the…. A patch is available.

How to fix or mitigate CVE-2026-8555?

Immediately initiate inventory of Chrome deployments on Windows systems to identify installations running versions prior to 148.0.7778.168. Within 7 days, deploy Google Chrome version 148.0.7778.168 or later Stable channel builds to all affected Windows endpoints through automated patch management systems, prioritizing user-facing systems. Complete deployment verification by day 30 and confirm no instances of pre-patched versions remain in production.

Google Chrome CVE-2026-8555

EUVD-2026-30471 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-v234-76xr-355f

RCE Denial Of Service Google Use After Free Memory Corruption Microsoft

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted-page delivery gives AV:N/AC:L/PR:N, victim navigation makes UI:R, and browser-process RCE yields full C:H/I:H/A:H within an unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:19 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on Windows before 148.0.7778.168 stems from a use-after-free in the GTK component, letting a remote attacker run arbitrary code when a victim opens a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable channel build; no public exploit is identified at time of analysis, EPSS risk is low (0.08%), and CISA SSVC marks exploitation status as none.

Technical ContextAI

The flaw is a CWE-416 use-after-free, a memory-corruption class where a pointer to freed heap memory is reused, allowing an attacker to control the contents at that address and steer execution. It resides in Chrome's GTK integration layer (the toolkit Chrome uses for native Linux-style widgets/theming), reached through the renderer while processing attacker-supplied HTML. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Google Chrome desktop browser; the advisory specifically scopes impact to the Windows build prior to 148.0.7778.168. Chromium tracks the underlying issue at issues.chromium.org/issues/500033878.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.168 (Stable channel) - update Chrome to 148.0.7778.168 or later on Windows and restart the browser to apply, per https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome auto-updates by default, so verify via chrome://settings/help that the build is at or above the fixed version and force-relaunch on managed fleets. As an interim compensating control before patching, restrict users from browsing untrusted sites, since exploitation requires loading attacker HTML; site isolation and enabling the enhanced/strict Safe Browsing mode raise the bar but do not fully remediate the underlying use-after-free. Downstream distributors (Red Hat, SUSE, Microsoft, referenced in tags) should track their respective rebuilt Chromium/Chrome packages for the corresponding fixed release.