Medium severity4.2NVD Advisory· Published May 6, 2026· Updated May 7, 2026
CVE-2026-8021
CVE-2026-8021
Description
Script injection in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.htmlnvdVendor AdvisoryRelease Notes
- issues.chromium.org/issues/498417031nvdPermissions Required
News mentions
39- PoC Code Published for Critical NGINX VulnerabilitySecurityWeek · May 16, 2026
- Chrome 148 Update Patches Critical VulnerabilitiesSecurityWeek · May 15, 2026
- Browser Run: now running on Cloudflare Containers, it’s faster and more scalableCloudflare Blog · May 13, 2026
- Microsoft on pace to break annual vulnerability record as AI-driven patch wave takes holdThe Record · May 13, 2026
- Risky Business #837 -- GitHub Actions footgun claims TanStackRisky Business · May 13, 2026
- Patch Tuesday - May 2026Rapid7 Blog · May 13, 2026
- Patch Tuesday, May 2026 EditionKrebs on Security · May 12, 2026
- Microsoft May 2026 Patch Tuesday, (Tue, May 12th)SANS Internet Storm Center · May 12, 2026
- Microsoft’s May 2026 Patch Tuesday Addresses 118 CVEs (CVE-2026-41103)Tenable Blog · May 12, 2026
- Cookie thieves caught stealing dev secrets via fake Claude Code installersThe Register Security · May 11, 2026
- 11th May – Threat Intelligence ReportCheck Point Research · May 11, 2026
- A week in security (May 4 – May 10)Malwarebytes Labs · May 11, 2026
- Microsoft says Edge’s plaintext password behavior is “by design”Malwarebytes Labs · May 8, 2026
- Vulnerability in Claude Extension for Chrome Exposes AI Agent to TakeoverSecurityWeek · May 8, 2026
- VoidStealer Malware Darts Past Google Chrome's EncryptionDark Reading · May 6, 2026
- Google Chrome’s silent 4GB AI download problem [updated]Malwarebytes Labs · May 6, 2026
- Attackers Actively Exploiting Critical Vulnerability in Breeze Cache PluginWordfence Blog · May 5, 2026
- Cleartext Passwords in MS Edge? In 2026?, (Mon, May 4th)SANS Internet Storm Center · May 5, 2026
- Google to pay up to $1.5 million for zero-click Pixel Titan M exploitsHelp Net Security · May 5, 2026
- SSL.com rotates their root certificate today, (Tue, May 5th)SANS Internet Storm Center · May 5, 2026
- Google now offers up to $1.5 million for some Android exploitsBleepingComputer · May 5, 2026
- CloudZ RAT potentially steals OTP messages using Pheno pluginCisco Talos Intelligence · May 5, 2026
- Google Adjusts Bug Bounties: Chrome Payouts Drop as Android Rewards Rise Amid AI SurgeSecurityWeek · May 1, 2026
- Today's Odd Web Requests, (Wed, Apr 29th)SANS Internet Storm Center · Apr 29, 2026
- HTTP Requests with X-Vercel-Set-Bypass-Cookie Header, (Tue, Apr 28th)SANS Internet Storm Center · Apr 28, 2026
- Metasploit Wrap-Up 04/17/2026Rapid7 Blog · Apr 17, 2026
- Shared Dictionaries: compression that keeps up with the agentic webCloudflare Blog · Apr 17, 2026
- The Good, the Bad and the Ugly in Cybersecurity – Week 16SentinelOne Labs · Apr 17, 2026
- Attackers Actively Exploiting Critical Vulnerability in Ninja Forms – File Upload PluginWordfence Blog · Apr 16, 2026
- PowMix botnet targets Czech workforceCisco Talos Intelligence · Apr 16, 2026
- Securing the Software Supply Chain: How SentinelOne’s AI EDR Autonomously Blocked the CPU-Z Watering Hole Cyber AttackSentinelOne Labs · Apr 14, 2026
- Patch Tuesday - April 2026Rapid7 Blog · Apr 14, 2026
- Patch Tuesday, April 2026 EditionKrebs on Security · Apr 14, 2026
- 6th April – Threat Intelligence ReportCheck Point Research · Apr 6, 2026
- The Good, the Bad and the Ugly in Cybersecurity – Week 14SentinelOne Labs · Apr 3, 2026
- 30th March – Threat Intelligence ReportCheck Point Research · Mar 30, 2026
- 16th March – Threat Intelligence ReportCheck Point Research · Mar 16, 2026
- Risky Business #828 -- The Coruna exploits are truly exquisiteRisky Business · Mar 11, 2026
- Risky Business #825 -- Palo Alto Networks blames it on the boogieRisky Business · Feb 18, 2026