CVE-2026-8563
Chromium: CVE-2026-8563 Insufficient policy enforcement in IFrame Sandbox
CVE-2026-8563 is fixed in 8 products on 2 platforms, first by Google Chrome Dev (EXE) 149.0.7779.3, released April 9, 2026. It is not reported as exploited. Patch Radar priority: Routine.
RoutineFixed on 2 platforms
CVSS
4.3
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0018
7th percentile
<p>This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see <a href="https://chromereleases.googleblog.com/2025">Google Chrome Releases</a> for more information</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Google Chrome (EXE) | 148.0.7778.168 | Google Chrome (EXE) 148.0.7778.168 | May 12, 2026 |
| Google Chrome Beta (EXE) | 149.0.7827.3 | Google Chrome Beta (EXE) 149.0.7827.3 | May 6, 2026 |
| Google Chrome Dev (EXE) | 149.0.7779.3 | Google Chrome Dev (EXE) 149.0.7779.3 | Apr 9, 2026 |
| Microsoft Edge | 148.0.3967.70 | Microsoft Edge 148.0.3967.70 | May 15, 2026 |
| Microsoft Edge Beta | 151.0.4129.59 | Microsoft Edge Beta 151.0.4129.59 | Jul 31, 2026 |
| Microsoft Edge Dev | 152.0.4167.0 | Microsoft Edge Dev 152.0.4167.0 | Jul 20, 2026 |
| Microsoft Edge WebView2 Runtime | 148.0.3967.70 | Microsoft Edge WebView2 Runtime 148.0.3967.70 | May 15, 2026 |
| Linux | |||
| chromium · Debian 12.15 (bookworm) | 148.0.7778.167-1~deb12u1 | DEBIAN-CVE-2026-8563 | May 27, 2026 |
| chromium · Debian 13.5 (trixie) | 148.0.7778.167-1~deb13u1 | DEBIAN-CVE-2026-8563 | May 27, 2026 |
| chromium · Debian 14 | 148.0.7778.167-1 | DEBIAN-CVE-2026-8563 | May 27, 2026 |
| chromium · opensuse-leap 16.0 | 148.0.7778.215-bp160.1.1 | OPENSUSE-SU-2026:20849-1 | Aug 31, 2026 |