PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8570 Google CVE debrief

A type confusion vulnerability in Google Chrome's V8 JavaScript engine, fixed in version 148.0.7778.168, could allow remote attackers to extract sensitive information from process memory via a crafted HTML page. The vulnerability was published on May 14, 2026, and last modified on May 19, 2026. Google has rated this as Medium severity. The issue stems from improper type handling in V8 (CWE-843), which can lead to out-of-bounds memory access and information disclosure when processing malicious JavaScript. No known exploitation in ransomware campaigns has been reported.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-19
Advisory published
2026-05-14
Advisory updated
2026-05-19

Who should care

Organizations relying on Google Chrome for business operations, security teams managing browser security postures, and users handling sensitive data in web applications should prioritize this update to prevent potential information leakage through malicious web content.

Technical summary

CVE-2026-8570 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine used by Google Chrome. The flaw occurs when V8 incorrectly handles object types during JavaScript execution, potentially leading to out-of-bounds memory reads. A remote attacker can exploit this by convincing a user to visit a malicious HTML page containing crafted JavaScript, resulting in disclosure of sensitive information from the browser process memory. The vulnerability affects Chrome versions prior to 148.0.7778.168. The CVSS 3.1 score of 6.5 reflects network accessibility, low attack complexity, required user interaction, and high confidentiality impact with no integrity or availability effects.

Defensive priority

medium

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.168 or later
  • Enable automatic browser updates to ensure timely patching
  • Consider site isolation policies to limit impact of renderer exploits
  • Monitor for unusual memory access patterns in browser processes
  • Review and restrict execution of untrusted HTML/JavaScript content

Evidence notes

CVE description confirms type confusion in V8 with information disclosure impact. NVD analysis shows CVSS 6.5 (Medium) with network attack vector, low complexity, and no privileges required. Chrome Release Notes confirm fix in 148.0.7778.168. Chromium issue tracker reference indicates restricted access to technical details.

Official resources

2026-05-14