PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8517 Google CVE debrief

CVE-2026-8517 is a critical object lifecycle vulnerability in Google Chrome's WebShare feature on macOS, rated CVSS 8.8 (HIGH). The flaw, published 2026-05-14 and last modified 2026-05-19, allows remote code execution when a user is tricked into performing specific UI gestures on a malicious HTML page. The vulnerability stems from improper resource lifecycle management (CWE-664) in the WebShare implementation. Google has addressed this in Chrome stable channel version 148.0.7778.168 and later. The attack requires user interaction but no privileges, with network-based exploitation possible. While the vendor field indicates Apple/medium confidence, the CPE data and advisory sources confirm this is a Google Chrome vulnerability affecting macOS systems. No known exploitation in ransomware campaigns has been documented, and the issue has not been added to CISA's KEV catalog.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-19
Advisory published
2026-05-14
Advisory updated
2026-05-19

Who should care

macOS users and administrators running Google Chrome; organizations with bring-your-own-device policies; security teams monitoring browser-based attack vectors; developers implementing WebShare functionality in web applications

Technical summary

The vulnerability exists in Chrome's WebShare API implementation on macOS, where improper object lifecycle management can lead to use-after-free or similar memory corruption conditions. When a user interacts with a crafted HTML page that manipulates WebShare through specific UI gestures, the corrupted state can be exploited to execute arbitrary code in the browser context. The attack vector is network-based with low complexity, requiring only that a user be convinced to perform the triggering actions. The fix in 148.0.7778.168 corrects the lifecycle handling to prevent the exploitable condition.

Defensive priority

critical

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.168 or later on all macOS endpoints
  • Review and restrict WebShare API usage in enterprise environments where not required
  • Deploy browser update policies to ensure automatic patching
  • Monitor for suspicious HTML pages attempting to trigger WebShare UI gestures
  • Consider disabling WebShare via enterprise policy if functionality is not business-critical

Evidence notes

Primary sources: NVD record with Chrome Release Blog advisory and Chromium issue tracker reference. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CWE-664 (Improper Control of a Resource Through its Lifetime) identified. Fixed version: 148.0.7778.168.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8517 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8517

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8517 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8517

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.