PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8547 Google CVE debrief

A high-severity privilege escalation vulnerability in Google Chrome on Windows, published 2026-05-14 and last modified 2026-05-19. Insufficient policy enforcement in the Passwords component allows a remote attacker who has already compromised the renderer process to escalate privileges via a crafted HTML page. Affected versions are prior to 148.0.7778.168 on Windows. The CVSS 3.1 score of 7.5 reflects network attack vector, high attack complexity, no privileges required, user interaction required, and high impacts to confidentiality, integrity, and availability. The underlying weakness is categorized as CWE-862 (Missing Authorization). No known exploitation in ransomware campaigns has been documented, and this CVE is not listed in CISA KEV.

Vendor
Google
Product
Chrome
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-19
Advisory published
2026-05-14
Advisory updated
2026-05-19

Who should care

Organizations with Windows endpoints running Google Chrome, particularly those in high-threat environments where renderer exploitation is a concern. Security teams managing browser security configurations and incident responders tracking privilege escalation chains in browser-based attacks.

Technical summary

The vulnerability exists in Chrome's Passwords component on Windows, where policy enforcement is insufficient to prevent a compromised renderer process from escalating privileges. An attacker who has achieved renderer compromise—typically through a separate vulnerability—can leverage a crafted HTML page to bypass intended access controls. The attack requires user interaction and high complexity but yields complete compromise of confidentiality, integrity, and availability within the Chrome process context. The fix in version 148.0.7778.168 strengthens policy enforcement to block this escalation path.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome on Windows to version 148.0.7778.168 or later to remediate the privilege escalation vulnerability in the Passwords component.
  • Prioritize patching on endpoints where Chrome runs with elevated privileges or where renderer process compromise is a plausible attack scenario.
  • Monitor for anomalous renderer process behavior or unexpected password manager access attempts as potential indicators of exploitation.
  • Review application control policies to restrict execution of untrusted HTML content in Chrome where feasible.

Evidence notes

CVE description and metadata sourced from NVD with vendor advisory from Google Chrome Releases. CPE criteria confirm Windows-specific impact with version bound at 148.0.7778.168. CVSS vector and CWE-862 classification derived from NVD enrichment. No KEV entry present per source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8547 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8547

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8547 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8547

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.