Description
Out of bounds read in FileSystem in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Published: 2026-05-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Chrome for macOS has a defect that allows an out‑of‑bounds read in the FileSystem component. An attacker can craft a malicious HTML page that tricks a user into performing specific UI gestures, enabling the attacker to read arbitrary data from the Chrome process memory. The vulnerability is characterized by CWE‑125 and is classified as high severity by Chromium security evaluators.

Affected Systems

Affected products are Google Chrome on macOS, versions prior to 148.0.7778.168. This includes all builds of the stable channel before the 148.0.7778.168 release.

Risk and Exploitability

The exploit requires the user to be tricked into interacting with a malicious UI element, making it a remote but user-dependent attack. The CVSS score is 5.3, indicating moderate severity, while Chromium labels it high. There is no KEV listing. The absence of an EPSS score indicates no quantified exploitation probability is available, but the combination of user interaction and moderate severity suggests a moderate risk that should be mitigated swiftly.

Generated by OpenCVE AI on May 14, 2026 at 23:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 148.0.7778.168 or later via the official update channel
  • Switch to the Chrome stable channel if currently on an alternative channel to ensure the security fix is applied
  • Verify that update settings (chrome://settings/help) are enabled so future patches are applied automatically

Generated by OpenCVE AI on May 14, 2026 at 23:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6273-1 chromium security update
History

Fri, 15 May 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome macOS Out-of-Bounds Read via Crafted HTML UI chromium-browser: chromium-browser: Out of bounds read in FileSystem
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 14 May 2026 23:45:00 +0000

Type Values Removed Values Added
Title Chrome macOS Out-of-Bounds Read via Crafted HTML UI

Thu, 14 May 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 14 May 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 14 May 2026 20:15:00 +0000

Type Values Removed Values Added
Description Out of bounds read in FileSystem in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-125
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-14T21:29:01.818Z

Reserved: 2026-05-14T05:40:18.462Z

Link: CVE-2026-8543

cve-icon Vulnrichment

Updated: 2026-05-14T21:28:57.418Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-14T20:17:15.173

Modified: 2026-05-14T22:16:48.420

Link: CVE-2026-8543

cve-icon Redhat

Severity : Important

Publid Date: 2026-05-14T19:52:23Z

Links: CVE-2026-8543 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-14T23:30:31Z

Weaknesses