What is the CVSS score of CVE-2026-8580?

CVE-2026-8580 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-8580?

Google Chrome versions prior to 148.0.7778.168 contain a critical sandbox escape vulnerability that allows remote code execution when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-8580?

Within 24 hours, catalog Chrome deployments across the organization and notify IT teams of the critical update requirement. Within 7 days, deploy Chrome version 148.0.7778.168 to all endpoints, prioritizing systems that access high-risk content or untrusted networks. Within 30 days, verify 100% compliance through endpoint monitoring, document any exceptions with business justification, and confirm that no systems remain on vulnerable versions prior to closing this vulnerability ticket.

Google Chrome CVE-2026-8580

EUVD-2026-30402 CRITICAL

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-x92g-vvxp-v39w

Denial Of Service Google Use After Free Memory Corruption

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote crafted page with no privileges but requiring user navigation (UI:R); AC:H because a UAF sandbox escape needs heap grooming and Chromium rated it Medium; S:C and C/I/A:H reflect full compromise beyond the sandbox.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:13 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

9.6 (CRITICAL)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Mojo IPC layer allows a remote attacker who lures a victim to a crafted HTML page to exploit a use-after-free (CWE-416) and potentially break out of the renderer sandbox on versions prior to 148.0.7778.168. Google fixed the flaw in the stable desktop channel (148.0.7778.168), and there is no public exploit identified at time of analysis (EPSS 0.07%, not in CISA KEV). Note a signal conflict: the CVSS base score is 9.6 (Critical) while Chromium's own triage rated the severity only Medium, so real-world exploitability is likely lower than the raw score implies.

Technical ContextAI

The vulnerability lives in Mojo, Chromium's core inter-process communication (IPC) framework that brokers messages between the sandboxed renderer process and the more privileged browser process. A use-after-free (CWE-416) occurs when code continues to reference memory that has already been freed, allowing an attacker who controls heap allocation to place attacker-influenced data where the stale pointer still points, leading to controlled memory corruption. Because Mojo sits on the trust boundary between the low-privilege renderer and the browser process, a memory-corruption bug there is a classic primitive for a sandbox escape rather than a mere renderer crash. The affected component is identified by CPE cpe:2.3:a:google:chrome (all versions below the fixed build), and the same Chromium engine underpins downstream distributions (Red Hat, SUSE packages are tagged), so the exposure extends beyond Google's official builds.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on all desktop platforms; Chrome typically auto-updates, so ensure the browser has been fully restarted to apply the new build and verify via chrome://settings/help. For managed fleets, push the updated build through your enterprise update policy and confirm rollout. Downstream users on Red Hat or SUSE Chromium packages should apply the corresponding distribution updates as they become available. Reference the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html and the Chromium issue tracker entry https://issues.chromium.org/issues/496639647. As an interim compensating control until updates land, restrict browsing to trusted sites and consider enabling site isolation / strict renderer hardening already default in Chrome, and use URL filtering to block untrusted HTML content - with the trade-off that this reduces but does not eliminate exposure since any attacker-controlled page could be the delivery vector.