PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8513 Google CVE debrief

A use-after-free vulnerability in the Input component of Google Chrome on Android allows a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox. The vulnerability is classified as Critical severity by Chromium security and carries a CVSS 3.1 score of 8.3 (HIGH). The flaw affects Chrome versions prior to 148.0.7778.168 on Android. Successful exploitation requires user interaction (UI:R) and high attack complexity (AC:H), but can result in complete compromise of confidentiality, integrity, and availability with scope change impact. The underlying weakness is CWE-416 (Use After Free). Google addressed this vulnerability in the Stable Channel update released May 12, 2026. No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA KEV.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-19
Advisory published
2026-05-14
Advisory updated
2026-05-19

Who should care

Organizations with Android device fleets running Chrome browser, mobile security teams, BYOD program administrators, and users handling sensitive data on Android devices should prioritize this patch. The sandbox escape potential makes this particularly critical for environments relying on browser isolation for security boundaries.

Technical summary

The vulnerability exists in the Input handling code of Google Chrome's Blink rendering engine on Android. A use-after-free condition can be triggered when processing crafted HTML content, leading to memory corruption that an attacker with renderer process compromise can leverage to escape the browser sandbox. The attack vector is network-based with required user interaction, typically through visiting a malicious web page. The high attack complexity reflects the need for prior renderer compromise and reliable exploitation of the memory corruption primitive. Scope change (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component's security scope, consistent with sandbox escape characteristics. The fix was released in Chrome Stable Channel version 148.0.7778.168 on May 12, 2026.

Defensive priority

critical

Recommended defensive actions

  • Update Google Chrome on Android to version 148.0.7778.168 or later immediately
  • Prioritize patching for devices with high-risk user profiles or access to sensitive data
  • Monitor for anomalous renderer process crashes that may indicate exploitation attempts
  • Review application sandboxing configurations as defense-in-depth
  • Restrict browsing to trusted sites where feasible until patching is complete
  • Enable site isolation features if not already active to limit renderer compromise impact

Evidence notes

CVE description confirms use-after-free in Input component with sandbox escape potential. CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H supports HIGH severity rating. CPE criteria confirms affected product as Google Chrome on Android with version bound excluding 148.0.7778.168. Chromium issue tracker reference indicates restricted access (Permissions Required). Vendor advisory from Chrome Releases blog confirms fix in Stable Channel update dated May 12, 2026.

Official resources

2026-05-14