Description
Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Published: 2026-05-14
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A heap buffer overflow occurs in the WebML component of Google Chrome on Windows versions prior to 148.0.7778.168, representing a CWE-122 and CWE-787 weakness. The vulnerability allows a remote attacker to supply a specially crafted HTML page that can corrupt the browser's heap memory. Based on the description, it is inferred that heap corruption could lead to arbitrary code execution or other destructive actions, potentially compromising confidentiality, integrity, or availability.

Affected Systems

Google Chrome users on Windows with versions before 148.0.7778.168 are affected by this flaw.

Risk and Exploitability

The CVSS base score of 8.8 indicates a high severity, but no EPSS value is available, suggesting limited publicly known exploitation. The attack can be launched remotely from a web page, and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on May 15, 2026 at 13:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to 148.0.7778.168 or later.
  • Disable the WebML feature via Chrome flags or group policy until an updated version is installed.
  • Block or quarantine crafted HTML content from untrusted sources using web filtering or content security policies.

Generated by OpenCVE AI on May 15, 2026 at 13:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6273-1 chromium security update
History

Fri, 15 May 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Heap buffer overflow in WebML
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 15 May 2026 00:45:00 +0000

Type Values Removed Values Added
Title Chrome WebML Heap Buffer Overflow Allowing Remote Heap Corruption

Thu, 14 May 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 14 May 2026 22:00:00 +0000

Type Values Removed Values Added
Title Chrome WebML Heap Buffer Overflow Allowing Remote Heap Corruption
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 14 May 2026 20:15:00 +0000

Type Values Removed Values Added
Description Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-122
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-15T03:57:34.081Z

Reserved: 2026-05-14T05:40:15.548Z

Link: CVE-2026-8531

cve-icon Vulnrichment

Updated: 2026-05-14T21:45:56.113Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-14T20:17:13.930

Modified: 2026-05-14T22:16:47.267

Link: CVE-2026-8531

cve-icon Redhat

Severity : Important

Publid Date: 2026-05-14T19:52:19Z

Links: CVE-2026-8531 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-15T14:00:21Z

Weaknesses