PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8536 Google CVE debrief

CVE-2026-8536 is a site isolation bypass vulnerability in Google Chrome's ReadingMode feature on macOS. The flaw stems from insufficient validation of untrusted input, allowing a remote attacker who has already compromised the renderer process to bypass site isolation protections via a crafted HTML page. The vulnerability was assigned a High severity by Chromium security team but received a CVSS 3.1 score of 3.1 (Low) from NVD, reflecting the prerequisite of renderer compromise which significantly raises the attack complexity. The affected versions are Google Chrome on Mac prior to 148.0.7778.168. The vendor field indicates Apple with medium confidence based on CPE data, though this appears to be a platform association rather than direct vendor responsibility—Google Chrome is the affected product. The CVE was published on May 14, 2026 and last modified on May 19, 2026. No KEV listing or known ransomware campaign use has been identified.

Vendor
Google
Product
Chrome
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-19
Advisory published
2026-05-14
Advisory updated
2026-05-19

Who should care

Organizations running Google Chrome on macOS in security-sensitive environments; security teams monitoring for browser-based attacks; incident responders investigating potential renderer compromise followed by isolation bypass attempts.

Technical summary

The vulnerability exists in Chrome's ReadingMode feature where insufficient validation of untrusted input allows a compromised renderer process to bypass site isolation. Site isolation is a critical security boundary in Chromium-based browsers that prevents malicious websites from accessing cross-origin data. A successful bypass following renderer compromise could enable an attacker to access data from other sites that would normally be protected by isolation boundaries. The attack requires user interaction (UI:R) and high attack complexity (AC:H) due to the prerequisite renderer compromise, with low confidentiality impact (C:L) and no integrity or availability impact per the CVSS vector.

Defensive priority

medium

Recommended defensive actions

  • Update Google Chrome on macOS to version 148.0.7778.168 or later to remediate this vulnerability.
  • Monitor for signs of renderer process compromise, as this vulnerability requires prior compromise of the renderer to exploit.
  • Review and restrict untrusted HTML content execution where possible, particularly in environments with elevated security requirements.
  • Apply principle of least privilege for browser processes and consider additional site isolation hardening measures.

Evidence notes

Primary sources: NVD record with CPE criteria confirming Chrome versions prior to 148.0.7778.168 are vulnerable; Chromium issue tracker reference 495857582; Chrome Releases blog advisory. CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. CWE-20 (Improper Input Validation) identified as secondary weakness.

Official resources

2026-05-14