What is the CVSS score of CVE-2026-8570?

CVE-2026-8570 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8570?

Yes, a patch is available for CVE-2026-8570. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8570

EUVD-2026-30385 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-05-14 Chrome

GHSA-2863-2m4q-93pg

Information Disclosure Google Memory Corruption

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted HTML requires only user navigation (UI:R, PR:N); impact is confidentiality-only memory read with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:15 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

6.5 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

MEDIUM 6.5

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Type confusion in V8, Chrome's JavaScript engine, exposes potentially sensitive process memory to remote attackers in all Chrome versions prior to 148.0.7778.168. Exploitation requires a victim to navigate to a specially crafted HTML page, after which the type confusion bug can be leveraged to read memory contents from the renderer process. No active exploitation is confirmed (not in CISA KEV), EPSS is extremely low at 0.03%, and SSVC classifies exploitation as none - placing real-world urgency in the routine patching tier despite the CVSS 6.5 rating.

Technical ContextAI

V8 is the open-source JavaScript and WebAssembly engine embedded in Google Chrome and Chromium-based browsers. CWE-843 (Type Confusion) occurs when an object or resource is accessed using a type incompatible with how it was originally allocated - in a JIT-compiled engine like V8, this can cause the engine to misinterpret memory regions, permitting reads of adjacent or otherwise inaccessible memory. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions before 148.0.7778.168 across platforms, consistent with the tags referencing Google, Red Hat, and SUSE distributions that package Chromium. The Chromium security team classified this as Medium severity, aligning with the confidentiality-only impact profile.

RemediationAI

The primary fix is to update Google Chrome to version 148.0.7778.168 or later, as confirmed by the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's automatic update mechanism will deploy this for most desktop users without manual intervention; administrators managing enterprise fleets should push the update via policy. For Red Hat and SUSE environments distributing Chromium packages, monitor distribution-specific security advisories for downstream patch availability. If immediate patching is not possible, disabling JavaScript execution via enterprise policy (e.g., Chrome's DefaultJavaScriptSetting policy) eliminates the V8 attack surface entirely but will break most modern web functionality and should be considered only as a short-term measure in high-risk environments. No other confirmed workarounds are available for this specific V8 type confusion issue.