Cyber Resilience

CVE-2026-8556

Memory Safety in Google Chrome ≤ 148.0.7778.168

Published
14 May 2026
Modified
17 June 2026
Patch / advisory
CVSS Score v3.1 3.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS Score 0.0020 10th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-8556 is a low-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Google Chrome. Its CVSS base score is 3.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Why these techniques?

Post-renderer compromise in Chrome ANGLE enables cross-origin data leakage, directly facilitating browser session hijacking for data collection.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1185 Browser Session Hijacking Collectionconfidence: HIGH
Cross-origin data leak from compromised renderer enables browser session hijacking by stealing session tokens or cookies from other origins.
T1552 Unsecured Credentials Credential Accessconfidence: MEDIUM
Leaking cross-origin data can expose credentials or tokens stored in the browser or accessible via the compromised renderer.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-8545Same product: Google Chrome
CVE-2024-7972Same product: Google Chrome
CVE-2024-0810Same product: Google Chrome
CVE-2026-7346Same product: Google Chrome
CVE-2023-2940Same product: Google Chrome
CVE-2024-7024Same product: Google Chrome
CVE-2026-14383Same product: Google Chrome
CVE-2026-3910Same product: Google Chrome
CVE-2024-3159Same product: Google Chrome
CVE-2026-14407Same product: Google Chrome

Affected Assets

google
chrome
≤ 148.0.7778.168

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-4 Information Flow Enforcement
  • AC-3 Access Enforcement
  • SC-39 Process Isolation
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 8 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V17.3.2
  • V10.3.5

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces information flow restrictions between origins, blocking the cross-origin data leak from a compromised renderer.

prevent

Enforces access control policy on renderer process requests, preventing unauthorized cross-origin data access after compromise.

prevent

Provides process isolation for the renderer, limiting the impact of compromise and reducing the ability to leak cross-origin data.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

PR.AA-05 directly enforces policy-based access management and least privilege, eliminating most improper-access-control defects, yet CWE-284 also covers implementation flaws and design gaps outside a single management control.

PR.PS-01 mostly match
prevents

Hardened baselines and deviation monitoring directly eliminate most configuration-induced access-control defects, yet CWE-284 also encompasses code-level and design flaws outside the scope of configuration management alone.

PR.PS-06 mostly match
prevents

Secure SDLC practices (bounds checking, safe APIs, reviews) directly prevent this class of flaw.

ID.RA-01 partial match
prevents

Vulnerability scanning and code analysis directly surface buffer-boundary flaws.

ID.RA-08 partial match
prevents

Receiving and triaging vulnerability disclosures commonly includes buffer-related reports.

PR.AA-01 partial match
prevents

PR.AA-01 supplies managed identities/credentials that support but do not implement access-control decisions, so it only partially prevents CWE-284 in either direction.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Defining and enforcing explicit access rights and restrictions for each entity directly stops the assignment of permissions that exceed what is required, eliminating the root condition that allows improper access control.

prevents

Formal authorization, role-based provisioning, and timely revocation of access rights directly stop the creation of accounts or permissions that exceed what the business actually needs.

prevents

By enforcing explicit rules on which identities or groups may perform read, write, delete or execute operations and by denying anonymous access to sensitive data, the control directly stops the creation of overly permissive or missing access-control checks.

prevents

Requiring one-to-one mapping of identities to entities and timely removal of unused identities directly stops attackers from leveraging stale or shared accounts to bypass access restrictions.

prevents

By explicitly transferring security roles and responsibilities when personnel change jobs or leave, the control reduces the chance that former employees retain access rights they no longer need, thereby limiting improper access control.

prevents

Physical entry controls enforce explicit authorization and authentication at every access point, directly stopping unauthorized actors from reaching information-processing assets.

References