What is the CVSS score of EUVD-2026-30393?

EUVD-2026-30393 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-30393?

Google Chrome desktop versions before 148.0.7778.168 contain a sandbox escape vulnerability that could allow attackers to elevate compromised renderer processes to system-level access.. A patch is available.

How to fix or mitigate EUVD-2026-30393?

Within 24 hours: Inventory all Chrome desktop deployments to determine current versions and scope of exposure. Within 7 days: Deploy Chrome 148.0.7778.168 or later across all endpoints using your patch management process; Red Hat and SUSE Chromium packages are also available if used. Within 30 days: Confirm patch deployment completion, review endpoint logging for renderer process anomalies or suspicious HTML file interactions, and validate that no systems remain on vulnerable versions.

Google Chrome EUVD-2026-30393

| CVE-2026-8575 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-pwc7-pghh-4vww

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered crafted page (AV:N) with UI:R and high complexity given required prior renderer compromise; sandbox escape crosses trust boundary (S:C) yielding full browser-process impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:13 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome desktop before 148.0.7778.168 lets an attacker who already controls a compromised renderer process leverage a use-after-free in the browser UI component to break out of the renderer sandbox via a crafted HTML page. This is the second-stage bug in a typical browser exploit chain and Chromium rates it Medium severity; there is no public exploit identified at time of analysis and EPSS estimates only a 0.07% exploitation probability. Google has released a fixed stable-channel build, and Red Hat and SUSE have picked it up for their Chromium packages.

Technical ContextAI

The affected technology is Chromium's multi-process browser architecture, where untrusted web content runs in a sandboxed renderer process and privileged operations occur in the browser process. This flaw is a CWE-416 use-after-free in the 'UI' subsystem of the browser, meaning an object is freed while a dangling reference to it remains reachable, allowing the memory to be reallocated and manipulated. Because the bug lives in the higher-privileged browser/UI layer, successfully corrupting that freed object from a controlled renderer allows the attacker to influence browser-process execution and cross the sandbox boundary (reflected in the CVSS S:C scope change). The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies desktop Chrome as the affected product; the same engine underlies Chromium-based distributions rebuilt by Red Hat and SUSE.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on all desktop platforms; the fix is delivered through the Stable channel per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Trigger Chrome's built-in updater (chrome://settings/help) and relaunch to apply, and in managed fleets push the update via your endpoint or configuration management tooling to ensure the browser process actually restarts. For Chromium rebuilds, apply the corresponding updated packages from Red Hat and SUSE once published. No standalone workaround fully neutralizes a memory-corruption bug in the browser binary; as an interim compensating control you can reduce renderer-compromise exposure by restricting untrusted browsing and enabling stricter site isolation policies, but these do not remove the underlying use-after-free, so prompt upgrade is the only reliable fix.