PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8547 Google CVE debrief

A high-severity privilege escalation vulnerability in Google Chrome on Windows, published 2026-05-14 and last modified 2026-05-19. Insufficient policy enforcement in the Passwords component allows a remote attacker who has already compromised the renderer process to escalate privileges via a crafted HTML page. Affected versions are prior to 148.0.7778.168 on Windows. The CVSS 3.1 score of 7.5 reflects network attack vector, high attack complexity, no privileges required, user interaction required, and high impacts to confidentiality, integrity, and availability. The underlying weakness is categorized as CWE-862 (Missing Authorization). No known exploitation in ransomware campaigns has been documented, and this CVE is not listed in CISA KEV.

Vendor
Google
Product
Chrome
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-19
Advisory published
2026-05-14
Advisory updated
2026-05-19

Who should care

Organizations with Windows endpoints running Google Chrome, particularly those in high-threat environments where renderer exploitation is a concern. Security teams managing browser security configurations and incident responders tracking privilege escalation chains in browser-based attacks.

Technical summary

The vulnerability exists in Chrome's Passwords component on Windows, where policy enforcement is insufficient to prevent a compromised renderer process from escalating privileges. An attacker who has achieved renderer compromise—typically through a separate vulnerability—can leverage a crafted HTML page to bypass intended access controls. The attack requires user interaction and high complexity but yields complete compromise of confidentiality, integrity, and availability within the Chrome process context. The fix in version 148.0.7778.168 strengthens policy enforcement to block this escalation path.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome on Windows to version 148.0.7778.168 or later to remediate the privilege escalation vulnerability in the Passwords component.
  • Prioritize patching on endpoints where Chrome runs with elevated privileges or where renderer process compromise is a plausible attack scenario.
  • Monitor for anomalous renderer process behavior or unexpected password manager access attempts as potential indicators of exploitation.
  • Review application control policies to restrict execution of untrusted HTML content in Chrome where feasible.

Evidence notes

CVE description and metadata sourced from NVD with vendor advisory from Google Chrome Releases. CPE criteria confirm Windows-specific impact with version bound at 148.0.7778.168. CVSS vector and CWE-862 classification derived from NVD enrichment. No KEV entry present per source data.

Official resources

2026-05-14