Is CVE-2026-8587 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8587 being exploited in the wild.

How severe is CVE-2026-8587?

High severity, with a CVSS score of 8.8, published 14 May 2026.

Which products and versions are affected?

Google Chrome prior to 148.0.7778.168, Prior to 148.0.7778.168.

Is there a fix for CVE-2026-8587?

A patch was published on 2026-05-12: Chrome Stable Channel Update released version 148.0.7778.168 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8587 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-8587?

Check whether you run Apple macOS or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8587: Google Chrome use after free in Extensions on Mac

CVE-2026-8587 · Severity: high · CVSS 8.8 · Published 2026-05-14

Google Chrome for Mac is vulnerable to a security flaw within its browser extension system. If a user is tricked into installing a malicious extension, an attacker can execute unauthorized code on the user's computer. This could lead to the theft of sensitive data, unauthorized access to accounts, or full system compromise.

Technologies: Apple macOS, Google Chrome. Vendors: Apple, Google.

Quick answers

Is CVE-2026-8587 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8587 being exploited in the wild.
How severe is CVE-2026-8587?: High severity, with a CVSS score of 8.8, published 14 May 2026.
Which products and versions are affected?: Google Chrome prior to 148.0.7778.168, Prior to 148.0.7778.168.
Is there a fix for CVE-2026-8587?: A patch was published on 2026-05-12: Chrome Stable Channel Update released version 148.0.7778.168 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8587 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-8587?: Check whether you run Apple macOS or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in the Extensions component of Google Chrome for macOS. The flaw is triggered when the browser attempts to access memory that has already been freed, specifically during the processing of a crafted Chrome Extension. To exploit this, an attacker must use social engineering to convince a user to install a malicious extension. Successful exploitation allows the attacker to achieve arbitrary code execution (RCE) within the context of the browser. The issue is addressed in Chrome version 148.0.7778.168 for Mac.

Affected products

Google Chrome Prior to 148.0.7778.168

Timeline

2026-05-12: patched: Chrome Stable Channel Update released version 148.0.7778.168
2026-05-14: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.