Is CVE-2026-8534 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8534 being exploited in the wild.

How severe is CVE-2026-8534?

High severity, with a CVSS score of 8.3, published 14 May 2026.

Which products and versions are affected?

Google Chrome prior to 148.0.7778.168; Google ChromeOS prior to 148.0.7778.168.

Is there a fix for CVE-2026-8534?

A patch was published on 2026-05-12: Fixed in version 148.0.7778.168 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8534 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8534?

Check whether you run Google Chrome, Google Chrome Os, Google ChromeOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8534: Google Chrome integer overflow in GPU component

CVE-2026-8534 · Severity: high · CVSS 8.3 · Published 2026-05-14

A security vulnerability exists in the graphics processing component of Google Chrome and ChromeOS. An attacker could use a specially crafted website to break out of the browser's security sandbox, potentially gaining control over the underlying operating system. This could lead to the theft of sensitive data or the installation of malicious software on the user's device.

Technologies: Google Chrome, Google Chrome Os, Google ChromeOS, Linux Kernel. Vendors: Google, Linux.

Quick answers

Is CVE-2026-8534 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8534 being exploited in the wild.
How severe is CVE-2026-8534?: High severity, with a CVSS score of 8.3, published 14 May 2026.
Which products and versions are affected?: Google Chrome prior to 148.0.7778.168; Google ChromeOS prior to 148.0.7778.168.
Is there a fix for CVE-2026-8534?: A patch was published on 2026-05-12: Fixed in version 148.0.7778.168 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8534 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8534?: Check whether you run Google Chrome, Google Chrome Os, Google ChromeOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in the GPU component of Google Chrome and ChromeOS. The flaw is triggered when processing a specially crafted HTML page. An attacker who has already compromised the renderer process can exploit this overflow to achieve a sandbox escape, potentially gaining elevated privileges on the host system. The vulnerability affects Linux and ChromeOS versions prior to 148.0.7778.168. Users are advised to update to the latest stable channel release to mitigate this risk.

Affected products

Google ChromeOS prior to 148.0.7778.168
Google Chrome prior to 148.0.7778.168 (Linux)

Timeline

2026-03-23: disclosed: Reported by Google internal researchers
2026-05-12: patched: Fixed in version 148.0.7778.168
2026-05-14: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.