PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8522 Google CVE debrief

A use-after-free vulnerability in Google Chrome's Downloads component on macOS allows remote code execution via crafted HTML pages. The vulnerability was assigned Critical severity by Chromium and carries a CVSS 3.1 score of 8.8 (HIGH). The flaw affects Chrome versions prior to 148.0.7778.168 on macOS. Use-after-free vulnerabilities in browser download handling can be triggered when malicious web content manipulates download state during asynchronous operations, potentially leading to memory corruption and arbitrary code execution in the browser process. Google released a stable channel update addressing this issue on May 12, 2026. No known exploitation in ransomware campaigns has been reported.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-19
Advisory published
2026-05-14
Advisory updated
2026-05-19

Who should care

Organizations with macOS endpoints running Google Chrome, particularly those in high-threat environments or with users who routinely download content from the web. Security teams responsible for browser security posture and patch management should prioritize this update given the Critical severity and RCE potential.

Technical summary

The vulnerability exists in Chrome's Downloads implementation on macOS, where improper memory management during download operations can result in a use-after-free condition. When processing crafted HTML content, an attacker can trigger memory corruption that may lead to arbitrary code execution within the browser's security context. The attack vector requires user interaction (UI:R) through visiting a malicious page, with network accessibility (AV:N) and low attack complexity (AC:L). The vulnerability does not require privileges (PR:N) and can result in complete confidentiality, integrity, and availability compromise (C:H/I:H/A:H) within the impacted scope.

Defensive priority

critical

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.168 or later on all macOS endpoints
  • Verify automatic update mechanisms are enabled for Chrome browser deployments
  • Review browser download policies and consider restricting automatic downloads from untrusted origins
  • Monitor for anomalous browser crashes or unexpected download behavior as potential exploitation indicators
  • Apply principle of least privilege for browser processes where technically feasible

Evidence notes

Vulnerability description and affected versions confirmed via NVD CPE data and Chrome Release Blog advisory. CWE-416 (Use After Free) classification sourced from Chromium security metadata. CVSS vector and severity ratings from official NVD record. Vendor attribution to Google Chrome established through multiple corroborating sources including Chrome release notes and Chromium issue tracker.

Official resources

2026-05-14T20:17:12.973Z