What is the CVSS score of EUVD-2026-23094?

EUVD-2026-23094 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-23094?

Yes, a patch is available for EUVD-2026-23094. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-23094

| CVE-2026-6364 MEDIUM

Out-of-bounds Read (CWE-125)

2026-04-15 Chrome

Buffer Overflow Information Disclosure Google

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network attack, low complexity, no privileges; user must open crafted file so UI:R; only confidentiality impacted.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:09 vuln.today

CVSS changed

Apr 16, 2026 - 14:22 NVD

6.5 (MEDIUM)

Patch released

Apr 15, 2026 - 19:46 nvd

Patch available

EUVD ID Assigned

Apr 15, 2026 - 19:45 euvd

EUVD-2026-23094

CVE Published

Apr 15, 2026 - 19:04 nvd

MEDIUM 6.5

DescriptionCVE.org

Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted file. (Chromium security severity: Medium)

AnalysisAI

Information disclosure in Google Chrome prior to version 147.0.7727.101 allows a remote attacker to obtain sensitive information from process memory by enticing a user to open a crafted file. The vulnerability, rated Medium severity by Chrome, resides in the Skia graphics library and is not currently listed in CISA KEV, with a low EPSS exploitation probability (0.03%). A patch is available from Google.

Technical ContextAI

The vulnerability lies in Skia, the 2D graphics library that underpins Chrome's rendering pipeline. It is classified as CWE-125 (Out-of-bounds Read), indicating that a crafted file-likely an image, font, or other graphical resource-can cause Skia to read beyond the bounds of an allocated buffer. The CPE string (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) confirms that all Chrome releases before the fix are affected. This class of flaw can leak stack or heap memory contents, potentially exposing secrets such as other tabs' data or authentication tokens.

RemediationAI

Upgrade Google Chrome to version 147.0.7727.101 or later, as detailed in the vendor advisory (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html). Ensure automatic updates are enabled to receive the fix promptly. If patching cannot be performed immediately, a temporary workaround is to avoid opening files from untrusted sources within Chrome, though this mitigation is impractical for general browsing and does not address drive-by exploitation via embedded content, as user interaction would still be required to visit a malicious site hosting the crafted file.