What is the CVSS score of EUVD-2026-30458?

EUVD-2026-30458 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30458?

Yes, a patch is available for EUVD-2026-30458. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-30458

| CVE-2026-8543 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-14 Chrome

GHSA-h69r-vw7v-6c65

Buffer Overflow Information Disclosure Google

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network delivery via crafted page; AC:H reflects required UI gestures and timing constraints; C:H for arbitrary process memory read; no integrity or availability impact applies.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:26 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

5.3 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

MEDIUM 5.3

DescriptionCVE.org

Out of bounds read in FileSystem in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read in the FileSystem component of Google Chrome on macOS (prior to 148.0.7778.168) exposes process memory contents to a remote attacker via a crafted HTML page. Exploitation requires high attack complexity and a user to perform specific UI gestures, substantially constraining opportunistic mass exploitation. No public exploit code has been identified and EPSS sits at the 8th percentile; CISA has not listed this in KEV, and SSVC classifies exploitation status as none.

Technical ContextAI

The vulnerability is rooted in CWE-125 (Out-of-bounds Read) within Chrome's FileSystem API implementation on macOS. The FileSystem component reads memory beyond the bounds of an allocated buffer, allowing adjacent process memory to be surfaced to an attacker-controlled page. The macOS-specific scope (confirmed by the CVE description) suggests the flaw is tied to platform-specific FileSystem API bindings or memory layout behavior unique to macOS Chrome builds. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions prior to the fix, and the underlying defect is tracked as Chromium issue 497095799. The tags referencing 'Buffer Overflow' alongside CWE-125 indicate the read may be triggered by a boundary condition in buffer handling within the FileSystem subsystem.

RemediationAI

Upgrade Google Chrome on macOS to version 148.0.7778.168 or later, as detailed in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's built-in auto-update mechanism will apply this silently for most consumer deployments; enterprise environments using managed Chrome deployments (via Google Admin or MDM) should verify the update has been pushed and confirm the installed version via chrome://version. As a compensating control for environments that cannot immediately update, restrict macOS Chrome users from visiting untrusted or external web content, and enforce Chrome's Enhanced Safe Browsing policy to reduce exposure to crafted pages - note these controls reduce but do not eliminate risk and may impact browsing functionality. No workaround eliminates the underlying flaw; patching to 148.0.7778.168 is the only definitive fix.