What is the CVSS score of CVE-2026-8563?

CVE-2026-8563 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8563?

Yes, a patch is available for CVE-2026-8563. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8563

EUVD-2026-30380 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-05-14 Chrome

GHSA-g2gq-v6g9-5365

Google Authentication Bypass Microsoft Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 16:22 vuln.today

CVSS changed

May 15, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restrictions can be bypassed in Google Chrome for Windows versions prior to 148.0.7778.168 when attackers craft malicious HTML pages that exploit insufficient sandbox policy enforcement in iframe elements. User interaction (opening/visiting the crafted page) is required for exploitation. Google released a patched version addressing this medium-severity flaw. With EPSS exploitation probability at 0.02% (4th percentile) and no KEV listing, this represents a moderate-priority issue primarily affecting organizations running outdated Chrome versions on Windows systems.

Technical ContextAI

This vulnerability stems from insufficient policy enforcement (CWE-693) in Chrome's iframe sandbox implementation on Windows platforms. HTML iframe sandbox attributes are security mechanisms designed to restrict capabilities of embedded content, including navigation controls that prevent sandboxed frames from redirecting the top-level browsing context or navigating other frames. The flaw allows specially crafted HTML to circumvent these navigation restrictions, potentially enabling clickjacking, phishing redirection, or cross-frame attacks. The vulnerability is platform-specific to Windows builds of Chrome, suggesting OS-level interaction in the sandbox enforcement logic. The Chromium bug tracker reference (issues/40061220) indicates this was identified through Chrome's internal security review process.

RemediationAI

Update Google Chrome to version 148.0.7778.168 or later immediately through Chrome's built-in updater (Settings → About Chrome) or by downloading from google.com/chrome. Chrome typically auto-updates within 24-48 hours but manual update ensures immediate protection. Organizations should push version 148.0.7778.168+ through enterprise management tools (WSUS, SCCM, Intune, or Chrome Browser Cloud Management). For environments unable to patch immediately, implement compensating controls: deploy browser isolation technology to sandbox all web content in remote containers, enforce strict URL filtering to block known-malicious domains delivering crafted HTML, and train users to avoid clicking links in unsolicited emails or messages. Note that disabling iframe sandbox features would create broader security gaps and is not recommended. Content Security Policy (CSP) headers with frame-ancestors and frame-src directives provide defense-in-depth but do not fully mitigate this client-side parsing vulnerability. Verify deployment success by checking chrome://settings/help shows version 148.0.7778.168 or higher. Reference advisory: http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html.