What is the CVSS score of CVE-2026-8571?

CVE-2026-8571 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8571?

Google Chrome on Android contains a sandbox escape vulnerability (CVE-2026-8571, CVSS 8.3) affecting versions before 148.0.7778.168 that allows attackers who compromise the renderer process to break…. A patch is available.

How to fix or mitigate CVE-2026-8571?

Within 24 hours, identify all Android devices in your organization running Chrome and document their current versions through MDM/device management systems. Within 7 days, deploy Chrome version 148.0.7778.168 or later to all affected devices using your standard mobile application deployment process, prioritizing devices with sensitive data access or elevated privileges. Within 30 days, verify complete deployment across your fleet through automated compliance scanning and confirm no devices remain on vulnerable versions before considering this item resolved.

Google Chrome CVE-2026-8571

EUVD-2026-30391 HIGH

Protection Mechanism Failure (CWE-693)

2026-05-14 Chrome

GHSA-mgqf-qh5m-w5xx

Information Disclosure Google

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R reflect the required prior renderer compromise plus crafted-page interaction; PR:N follows CVSS treatment of the renderer as untrusted, S:C and C/I/A:H capture the full sandbox escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.7 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:15 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome for Android before 148.0.7778.168 lets an attacker who has already compromised the renderer process break out of the sandbox through insufficient policy enforcement in the GPU component, escalating a contained renderer bug into fuller device compromise via a crafted HTML page. Rated Medium by Chromium but scored CVSS 8.3 by NVD due to the scope change and total technical impact. There is no public exploit identified at time of analysis and EPSS probability is low (0.09%).

Technical ContextAI

The flaw lives in Chrome's GPU process, which mediates hardware-accelerated rendering (WebGL, WebGPU, compositing) on behalf of the sandboxed renderer via IPC. CWE-693 (Protection Mechanism Failure) indicates the GPU process failed to correctly enforce a security policy on requests coming from the renderer, allowing a compromised renderer to reach functionality it should not, thereby crossing the sandbox boundary. On Android this boundary is a core mitigation because the renderer runs as an isolated, low-privilege process; weakening the GPU-side policy check undermines the multi-process sandbox model. The affected component is identified by CPE cpe:2.3:a:google:chrome and the Chromium issue tracker entry 491422244.

RemediationAI

Vendor-released patch: 148.0.7778.168 - update Google Chrome for Android to 148.0.7778.168 or later via the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); on Android, ensure Play Store auto-updates are enabled so the fixed build rolls out. Users of downstream Chromium builds (Red Hat, SUSE) should apply their distribution's corresponding Chromium update. No standalone workaround fully closes a GPU sandbox escape, but because exploitation requires a prior renderer compromise, interim risk can be reduced by keeping Chrome fully updated to eliminate the renderer bugs that would chain into this issue and by avoiding untrusted sites; on desktop-style deployments GPU acceleration can be disabled to shrink the attack surface, with the trade-off of degraded rendering performance, though this control is not practical on Android. Patching to 148.0.7778.168 is the only reliable fix.