What is the CVSS score of CVE-2026-8585?

CVE-2026-8585 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-8585?

Google Chrome on iOS versions before 148.0.7778.168 contains an out-of-bounds memory read vulnerability that could allow attackers to access sensitive data if a renderer process has been previously…. A patch is available.

How to fix or mitigate CVE-2026-8585?

Within 24 hours: Notify iOS device management teams and identify Chrome deployment scope across iOS fleet. Within 7 days: Distribute Chrome 148.0.7778.168 or later through mobile device management (MDM) and monitor deployment completion. Within 30 days: Verify 100% of managed iOS devices updated; document any unpatched devices and implement compensating controls for high-risk user populations.

Google Chrome CVE-2026-8585

EUVD-2026-30403 HIGH

Protection Mechanism Failure (CWE-693)

2026-05-14 Chrome

GHSA-jwm6-pr74-mmpq

Google Information Disclosure Apple Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:23 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

7.5 (None) 7.5 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory read in Google Chrome on iOS versions before 148.0.7778.168 enables remote attackers to access sensitive memory contents through a compromised renderer process. The vulnerability requires user interaction to visit a malicious webpage and exploitation of a prior renderer compromise. With EPSS at 0.03% and no known active exploitation, this represents a moderate risk primarily in targeted attack chains.

Technical ContextAI

The vulnerability stems from inappropriate implementation in Chrome's Media component on iOS, classified under CWE-693 (Protection Mechanism Failure). Chrome uses a multi-process architecture where the renderer process handles untrusted web content in a sandboxed environment. This vulnerability allows attackers who have already compromised the renderer (through a separate exploit) to read memory outside allocated bounds, potentially exposing sensitive data from other browser processes or the iOS system.

RemediationAI

Update Google Chrome on iOS to version 148.0.7778.168 or later through the App Store auto-update mechanism or manual update. Chrome's advisory confirms the patch is available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. For environments where immediate patching isn't possible, limit exposure by restricting browsing to trusted sites only and enabling iOS's Lockdown Mode for high-risk users, though this significantly reduces browser functionality. Monitor for signs of renderer exploitation attempts through security tooling.