What is the CVSS score of CVE-2026-8587?

CVE-2026-8587 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-8587?

Google Chrome on macOS versions prior to 148.0.7778.168 contains a high-severity use-after-free vulnerability in the Extensions subsystem that enables arbitrary code execution through malicious…. A patch is available.

How to fix or mitigate CVE-2026-8587?

Within 24 hours, inventory Chrome installations on macOS systems across your organization and identify any extensions installed from non-official sources; coordinate with endpoint management teams to prepare deployment procedures. Within 7 days, deploy Chrome version 148.0.7778.168 or later to all macOS endpoints through your endpoint management system, prioritizing systems with administrative privileges or sensitive data access. Within 30 days, implement extension installation restrictions via Chrome Enterprise policies or mobile device management to prevent users from installing unvetted extensions, and conduct security awareness training on browser extension risks.

Google CVE-2026-8587

EUVD-2026-30407 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-gqc5-p594-9chj

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:11 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Arbitrary code execution in Google Chrome on macOS (versions prior to 148.0.7778.168) stems from a use-after-free in the browser's Extensions subsystem, allowing an attacker who convinces a user to install a malicious extension to run arbitrary code through a crafted Chrome extension. Chromium rates the severity Medium, but the CVSS 3.1 base score is 8.8 (High) because the flaw yields full confidentiality, integrity, and availability impact once triggered. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and the EPSS probability is negligible (0.02%, 5th percentile), indicating no observed real-world exploitation to date.