What is the CVSS score of CVE-2026-8582?

CVE-2026-8582 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8582?

Yes, a patch is available for CVE-2026-8582. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8582

EUVD-2026-30400 MEDIUM

Improper Control of a Resource Through its Lifetime (CWE-664)

2026-05-14 Chrome

GHSA-6w53-h492-p28f

Google Information Disclosure

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network delivery via crafted HTML, AC:H for precise lifecycle timing required, UI:R for victim page visit, confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:12 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

5.3 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

MEDIUM 5.3

DescriptionCVE.org

Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Process memory disclosure in Google Chrome's Dawn WebGPU engine (prior to 148.0.7778.168) allows a remote attacker to read potentially sensitive data from the renderer process by directing a victim to a crafted HTML page. The flaw stems from an object lifecycle mismanagement in the Dawn graphics layer, falling under CWE-664, and results in high confidentiality impact despite a moderate overall CVSS score due to high attack complexity and required user interaction. No public exploit code has been identified and SSVC assessment indicates no known exploitation activity, placing this in the 'monitor and patch' tier rather than emergency response.

Technical ContextAI

Dawn is Chrome's open-source WebGPU implementation - the GPU abstraction layer that translates WebGPU API calls to native graphics APIs (Metal, Vulkan, D3D12). CWE-664 (Improper Control of a Resource Through its Lifetime) indicates that a GPU-managed or renderer-side object is accessed outside its valid lifecycle - either after destruction (use-after-free semantics) or before proper initialization - causing the engine to return stale or uninitialized memory contents to the JavaScript/WebGPU context. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms that all Chrome desktop releases prior to 148.0.7778.168 across all platforms are in scope. The Chromium issue tracker entry (issues.chromium.org/issues/497594413) is the upstream bug reference, and the Chrome security team classifies severity as Medium.

RemediationAI

The primary remediation is updating Google Chrome to version 148.0.7778.168 or later, confirmed by the Chrome stable channel release blog at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's auto-update mechanism will deliver this to most desktop users automatically; enterprise deployments managing Chrome via group policy or MDM should push the update through their standard patch distribution pipeline. For organizations that cannot immediately update, restricting access to untrusted or external web content via network proxy policies or browser isolation solutions (e.g., remote browser isolation) would reduce exposure, though these controls carry usability trade-offs. Disabling WebGPU via enterprise policy (--disable-webgpu flag or equivalent policy) would address the Dawn attack surface but may break web applications relying on WebGPU features. Red Hat and SUSE enterprise advisories should be monitored for Chromium package updates in those environments.