PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8582 Google CVE debrief

A medium-severity information disclosure vulnerability in Google Chrome's Dawn graphics component allows remote attackers to extract potentially sensitive data from process memory via a crafted HTML page. The flaw stems from an object lifecycle management issue in Dawn, Chrome's WebGPU implementation. Affected versions include all Chrome releases prior to 148.0.7778.168. Google addressed this vulnerability in the May 2026 stable channel update. No known exploitation in ransomware campaigns has been reported.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-19
Advisory published
2026-05-14
Advisory updated
2026-05-19

Who should care

Organizations with Chrome deployments, particularly those handling sensitive data in browser sessions; security teams monitoring browser-based attack vectors; developers using WebGPU APIs who may need to understand underlying implementation risks; enterprise administrators managing Chrome update cadences

Technical summary

CVE-2026-8582 is an object lifecycle vulnerability in Dawn, Chrome's WebGPU implementation. The flaw allows remote attackers to read sensitive information from process memory through a crafted HTML page. Dawn manages GPU resource lifecycles for WebGPU APIs; improper control of object lifetime permits memory contents to be exposed to attacker-controlled contexts. The vulnerability requires user interaction (visiting a malicious page) and has high attack complexity. Successful exploitation yields high confidentiality impact without affecting integrity or availability. The fix in Chrome 148.0.7778.168 corrects the lifecycle management logic in Dawn to prevent unauthorized memory access.

Defensive priority

medium

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.168 or later to remediate the Dawn object lifecycle vulnerability
  • Verify Chrome update status via chrome://settings/help and ensure automatic updates are enabled for future security patches
  • For managed enterprise environments, deploy the updated Chrome version through standard software distribution channels
  • Review browser security settings and consider enabling site isolation features as defense-in-depth
  • Monitor for unusual memory access patterns or GPU process crashes that may indicate exploitation attempts
  • Assess web application content filtering policies to reduce exposure to untrusted HTML content from unknown sources

Evidence notes

CVE published 2026-05-14; modified 2026-05-19. Chrome stable channel update released 2026-05-12 per vendor advisory. Chromium issue 497594413 tracked internally with restricted access. CVSS 5.3 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N indicates network attack vector with high complexity, requiring user interaction, resulting in high confidentiality impact. CWE-664 (Improper Control of a Resource Through its Lifetime) classified as secondary weakness source.

Official resources

2026-05-14