What is the CVSS score of EUVD-2026-30394?

EUVD-2026-30394 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-30394?

Google Chrome on Windows versions before 148.0.7778.168 contains a sandbox escape vulnerability that could allow an attacker with renderer-process access to execute code within the browser's core…. A patch is available.

How to fix or mitigate EUVD-2026-30394?

Within 24 hours, conduct an inventory of all Windows systems with Google Chrome and document current versions; simultaneously prepare a patch deployment plan targeting version 148.0.7778.168 or later and communicate timelines to stakeholders. Within 7 days, begin phased rollout of Chrome updates to production systems, prioritizing machines with elevated security requirements or sensitive data access. Within 30 days, complete patches across all Chrome installations and verify deployment via endpoint management tools, generating confirmation reports for audit and compliance records.

Google Chrome EUVD-2026-30394

| CVE-2026-8574 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-r6g5-hhqh-h5g4

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Attacker must already control the renderer process, so PR:H; UI:R and AC:H reflect victim page-load and heap-grooming, with S:C and full C/I/A for the browser-process sandbox escape.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:14 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows before 148.0.7778.168 stems from a use-after-free in the browser's Core component, allowing an attacker who has already compromised the renderer process to break out of the sandbox and potentially execute code in the more privileged browser process via a crafted HTML page. Google rates it Medium severity internally, though the assigned CVSS is 8.3 due to the scope change and total impact. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and SSVC records exploitation status as none.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's 'Core' - memory freed on the heap is subsequently dereferenced, and by grooming the heap an attacker can reuse that freed allocation to gain control over object pointers or vtables. Because the affected code lives on the browser-process side of Chrome's multi-process architecture (rather than in the sandboxed renderer), a successful trigger crosses the sandbox boundary, which is why CVSS marks Scope as Changed (S:C). The CPE cpe:2.3:a:google:chrome confirms the Chrome application is the affected component, and this class of bug is the most common source of Chromium sandbox-escape chains, typically paired with a separate renderer RCE bug.

RemediationAI

Update to Google Chrome 148.0.7778.168 or later on Windows; this is the vendor-released patch and Chrome will typically auto-update, but administrators should force the update and confirm via chrome://settings/help, then relaunch the browser to apply it. Reference the Chrome Stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. For Chromium-based derivatives (Edge, and Red Hat/SUSE-packaged builds), apply the corresponding vendor updates as they land. Because exploitation requires a pre-compromised renderer, interim compensating controls that reduce renderer-compromise exposure help: enable the Site Isolation / strict site isolation defaults (do not disable them), and consider deploying Chrome's stricter security posture (e.g. 'Enhanced Protection' Safe Browsing) via enterprise policy to lower the odds of the prerequisite renderer bug being reached - trade-off is minor added telemetry and occasional false-positive warnings.