PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8541 Google CVE debrief

An out-of-bounds read vulnerability in Google Chrome's UI component, present in versions prior to 148.0.7778.168, enables information disclosure from process memory. The vulnerability requires a compromised renderer process and user interaction with a crafted HTML page. Google has assigned this a High severity rating. The vendor field in source data incorrectly lists Apple; the affected product is Google Chrome per CPE criteria and advisory sources.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-19
Advisory published
2026-05-14
Advisory updated
2026-05-19

Who should care

Organizations running Google Chrome versions prior to 148.0.7778.168, particularly those with users who may visit untrusted web content. Security teams should prioritize this update due to the High severity rating from Google, though the CVSS base score of 5.3 reflects the prerequisite renderer compromise. Enterprises with strict sandboxing or site isolation policies may have reduced exposure.

Technical summary

The vulnerability exists in Chrome's UI component where an out-of-bounds read can occur when processing crafted HTML content. Successful exploitation requires prior compromise of the renderer process, after which the vulnerability allows reading potentially sensitive information from process memory. The attack vector is network-based with high attack complexity, requiring user interaction. The confidentiality impact is high with no integrity or availability impact. The fix was released in Chrome 148.0.7778.168.

Defensive priority

medium

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.168 or later
  • Verify Chrome version via chrome://settings/help and apply pending updates
  • For managed environments, deploy updated Chrome via enterprise update channels
  • Monitor for unusual renderer process crashes or unexpected memory access patterns
  • Review application sandboxing configurations to limit renderer compromise impact

Evidence notes

CVE description and CPE criteria confirm Google Chrome as the affected product. The vendor field 'Apple' appears to be a data quality issue in the source record; CPE criteria and Chrome Release Blog advisory confirm Google Chrome. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N yields score 5.3 (Medium). CWE-125 (Out-of-bounds Read) identified. No KEV entry present.

Official resources

2026-05-14