What is the CVSS score of CVE-2026-8572?

CVE-2026-8572 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8572?

Yes, a patch is available for CVE-2026-8572. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8572

EUVD-2026-30390 LOW

Protection Mechanism Failure (CWE-693)

2026-05-14 Chrome

GHSA-3fwf-96rh-jr6w

Google Information Disclosure Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:25 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

3.1 (None) 3.1 (LOW)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome on Android allows compromised renderer processes to access sensitive information from other sites via malicious HTML pages. Affects Chrome versions prior to 148.0.7778.168 on Android platforms. Attack requires high complexity (user interaction with crafted content) and prior renderer compromise, limiting practical exploitation. EPSS score of 0.03% (10th percentile) and SSVC assessment indicating no active exploitation align with the limited real-world risk profile despite the cross-origin information disclosure capability.

Technical ContextAI

This vulnerability stems from insufficient policy enforcement (CWE-693) in Chrome's Network component on Android. Browser security models rely on same-origin policy to isolate data between different websites. When a renderer process (the sandboxed component that processes web content) is compromised, Chrome's network policy checks should prevent cross-origin data access. This flaw allows an already-compromised renderer to bypass those checks and leak information from origins it should not access. The vulnerability is specific to the Android implementation of Chrome's networking stack, suggesting platform-specific policy enforcement code differs from desktop implementations. CPE identifier cpe:2.3:a:google:chrome indicates this affects the Google Chrome application itself rather than Chromium-based derivatives.

RemediationAI

Update Google Chrome on Android to version 148.0.7778.168 or later, which contains the vendor-released patch addressing the network policy enforcement flaw. The stable channel update is available through Google Play Store automatic updates or manual installation. Vendor advisory with complete update instructions and changelog is available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html with additional technical context at https://issues.chromium.org/issues/495405493. No workaround is provided by the vendor. Organizations managing Chrome deployments via enterprise policies should prioritize update rollout for Android devices. Note that this vulnerability requires a pre-compromised renderer, so standard browser security practices (avoiding untrusted sites, keeping all extensions updated, enabling Safe Browsing) provide defense-in-depth by reducing initial renderer compromise risk, though these are complementary to patching rather than substitutes.