What is the CVSS score of EUVD-2026-30388?

EUVD-2026-30388 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30388?

Yes, a patch is available for EUVD-2026-30388. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-30388

| CVE-2026-8568 LOW

Protection Mechanism Failure (CWE-693)

2026-05-14 Chrome

GHSA-3j3h-g4g8-qvq9

Google Authentication Bypass Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:25 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

3.1 (LOW)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in AI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass Site Isolation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Site Isolation bypass in Google Chrome prior to 148.0.7778.168 allows remote attackers who have already compromised the renderer process to access cross-site data via crafted HTML pages. The vulnerability affects Chrome's AI policy enforcement, enabling a second-stage attack after initial renderer compromise. Attack complexity is high, requiring both initial renderer compromise and user interaction. EPSS score of 0.02% indicates very low exploitation probability, and no active exploitation or public POC has been identified. Vendor patch is available in Chrome 148.0.7778.168.

Technical ContextAI

This vulnerability exploits insufficient policy enforcement in Google Chrome's AI features, classified under CWE-693 (Protection Mechanism Failure). Site Isolation is Chrome's fundamental security architecture that segregates content from different origins into separate renderer processes to prevent cross-site data leakage. The AI policy layer appears to have enforcement gaps that allow a compromised renderer to escape its sandboxed origin context. The attack requires initial renderer compromise as a prerequisite, making this a post-exploitation technique rather than an initial access vector. The CVSS vector shows network-based attack (AV:N) but high complexity (AC:H) and required user interaction (UI:R), with impact limited to low confidentiality breach (C:L) and no scope change (S:U), indicating the attacker remains constrained to the Chrome security boundary despite bypassing Site Isolation internally.

RemediationAI

Upgrade to Google Chrome version 148.0.7778.168 or later, which contains the patch for this vulnerability as confirmed in the May 2026 Stable Channel Update at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's automatic update mechanism will deploy this fix to most installations within 48-72 hours of release. Enterprise administrators using managed Chrome deployments should verify update policies allow timely patching or manually push version 148.0.7778.168 via management consoles. For environments where immediate patching is not feasible, implement defense-in-depth controls: disable Chrome AI features if enterprise policy allows (reduces attack surface but may impact user functionality requiring AI capabilities), enforce strict Content Security Policy headers on web applications to limit renderer compromise vectors, and monitor for signs of renderer exploitation through endpoint detection tools. Note that no workaround fully mitigates the Site Isolation bypass once renderer compromise occurs - patching remains the only complete remediation. Technical details at Chromium bug tracker issues/488728570 may inform additional hardening measures.