What is the CVSS score of EUVD-2026-30421?

EUVD-2026-30421 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-30421?

A vulnerability in Google Chrome for Windows (versions prior to 148.0.7778.168) could allow attackers who have already compromised the browser to escalate their access and potentially reach sensitive…. A patch is available.

How to fix or mitigate EUVD-2026-30421?

Within 24 hours, inventory all Chrome installations on Windows systems to identify instances running versions prior to 148.0.7778.168 using your endpoint management tools. Within 7 days, deploy Chrome version 148.0.7778.168 or later across all Windows systems using your standard patching process; most environments will auto-update but verify completion on any systems with update deferral policies. Within 30 days, confirm 100% deployment coverage and document any systems that remain on older versions due to compatibility constraints.

Google Chrome EUVD-2026-30421

| CVE-2026-8510 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-14 Chrome

GHSA-p7w3-579f-4cjj

Buffer Overflow Google Microsoft

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Reachable over the web (AV:N) via crafted HTML with UI:R, but AC:H reflects the required prior renderer compromise and unreliable overflow; total in-renderer impact gives C/I/A:H with S:U.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.0 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:52 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

7.5 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 7.5

DescriptionCVE.org

Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Out-of-bounds memory write in Google Chrome's Skia graphics library on Windows (versions prior to 148.0.7778.168) lets an attacker who has already compromised the renderer process trigger an integer overflow via a crafted HTML page, corrupting memory in a Critical-rated flaw. It is a second-stage primitive used to widen an existing renderer foothold, not a standalone remote-entry bug. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 21st percentile), consistent with the SSVC 'Exploitation: none' assessment.

Technical ContextAI

Skia is Chromium's 2D graphics rasterization engine, responsible for rendering paths, shapes, images and canvas/WebGL content across all Chrome platforms. The flaw is an integer overflow in Skia's handling of attacker-influenced geometry/size parameters from a crafted HTML page; when an oversized value wraps, subsequent allocation or index math underestimates a buffer and Skia writes past its bounds. Note a CWE mapping caveat: the input labels this CWE-472 (External Control of Assumed-Immutable Web Parameter), but the described integer-overflow-to-OOB-write behavior more naturally corresponds to CWE-190 (Integer Overflow or Wraparound) leading to CWE-787 (Out-of-bounds Write) - treat the specific CWE as low-confidence. Because the description states the renderer is already compromised, this operates inside the sandboxed renderer/GPU context and is typically one link in a multi-bug exploit chain.

RemediationAI

Vendor-released patch: 148.0.7778.168 - upgrade Google Chrome on Windows to 148.0.7778.168 or later, which for most users applies automatically; force it via chrome://settings/help and relaunch, or push the update through enterprise management (Google Update/ADMX policies) to guarantee coverage. Reference the Chrome Stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Because exploitation requires an already-compromised renderer, effective compensating controls until patching center on hardening the renderer entry point: ensure the Chrome sandbox and Site Isolation remain enabled (do not disable with --no-sandbox), keep users off untrusted sites, and consider enabling Enhanced Safe Browsing (trade-off: additional URL/telemetry sharing with Google). Chromium-based derivatives should be updated to a build that has rebased past this Skia fix.