What is the CVSS score of CVE-2026-8569?

CVE-2026-8569 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google are affected by CVE-2026-8569?

Google Chrome for macOS contains a sandbox escape vulnerability (CVE-2026-8569) affecting versions prior to 148.0.7778.168 that could allow attackers to compromise system security if users open…. A patch is available.

How to fix or mitigate CVE-2026-8569?

Within 24 hours, inventory all macOS systems with Chrome installations, issue guidance to users to avoid opening untrusted video files, and prepare deployment automation for Chrome 148.0.7778.168 or later. Within 7 days, complete deployment of the patched Chrome version to all macOS endpoints via MDM or enterprise deployment tools. Within 30 days, conduct verification scans to confirm patch installation across all systems and monitor security logs for exploitation attempts targeting this vulnerability.

Google CVE-2026-8569

EUVD-2026-30386 HIGH

Out-of-bounds Write (CWE-787)

2026-05-14 Chrome

GHSA-m34r-5p3p-q822

Buffer Overflow Google Memory Corruption

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:16 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome for macOS (versions prior to 148.0.7778.168) stems from an out-of-bounds write in the browser's media codec handling, letting a remote unauthenticated attacker who lures a victim into opening a crafted video file corrupt memory and potentially break out of the renderer sandbox. The flaw carries a CVSS 8.3 rating driven by a scope-changing, full-triad impact, though Chromium internally rated the security severity only Medium. There is no public exploit identified at time of analysis, EPSS is very low at 0.07%, and CISA SSVC records exploitation as none.