What is the CVSS score of CVE-2026-8581?

CVE-2026-8581 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-8581?

Google Chrome versions prior to 148.0.7778.168 contain a critical use-after-free vulnerability in the GPU component that allows remote code execution when users visit maliciously crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-8581?

Within 24 hours, inventory all Chrome installations across managed devices and prepare communication to end users about the mandatory security update. Within 7 days, deploy Google Chrome version 148.0.7778.168 or later to all systems through your standard patch management process, prioritizing user-facing devices. Within 30 days, confirm patch deployment is complete across the organization and consider implementing web content filtering or browser isolation for high-risk users accessing untrusted web content to provide defense-in-depth protection.

Google Chrome CVE-2026-8581

EUVD-2026-30401 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-xw77-7rcc-vw8q

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page needs no auth but requires the victim to visit it (UI:R); code execution stays within the sandbox (S:U) yet fully compromises that process (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:12 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Arbitrary code execution in Google Chrome's GPU component (prior to 148.0.7778.168) lets a remote attacker run code inside the renderer/GPU sandbox by luring a victim to a crafted HTML page. The flaw is a CWE-416 use-after-free that Chromium rates Medium, though CVSS scores it 8.8 (High). No public exploit is identified and there is no CISA KEV listing; EPSS is very low at 0.08%, indicating no observed exploitation activity at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's GPU process, which handles hardware-accelerated rendering, WebGL/WebGPU, and compositing on behalf of untrusted web content. A use-after-free (CWE-416) occurs when memory backing a GPU object is freed but a dangling reference is subsequently dereferenced, allowing an attacker to control freed-then-reallocated memory and steer execution. The single affected product per CPE is cpe:2.3:a:google:chrome (all versions before the fixed build). Notably, the description states code execution occurs 'inside a sandbox' - meaning this alone yields code execution within the constrained GPU/renderer sandbox rather than a full host compromise; a separate sandbox-escape chain would be required for system-level impact, consistent with the CVSS Scope:Unchanged (S:U) rating.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later via the Stable channel (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); restart the browser to complete the update since Chrome patches only apply after a relaunch. For managed fleets, push the updated build through enterprise policy/MDM and verify the version. On Red Hat and SUSE systems, apply the corresponding distribution package update for Chrome/Chromium. If patching must be briefly delayed, compensating controls include disabling hardware acceleration in Chrome settings (chrome://settings, 'Use graphics acceleration when available'), which reduces GPU-process attack surface at the cost of degraded rendering/video performance, and restricting browsing to trusted sites, since exploitation requires loading attacker-controlled HTML.