What is the CVSS score of EUVD-2026-30426?

EUVD-2026-30426 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-30426?

Google Chrome contains a critical vulnerability (CVE-2026-8511, CVSS 9.6) that allows remote code execution through a sandbox escape when employees visit compromised websites, potentially giving…. A patch is available.

How to fix or mitigate EUVD-2026-30426?

Within 24 hours, inventory all Google Chrome installations across endpoints and confirm systems running versions prior to 148.0.7778.168; prepare patch deployment communication and staging. Within 7 days, deploy Chrome version 148.0.7778.168 or later to all endpoints, prioritizing administrative workstations and systems with internet-facing roles. Within 30 days, verify patch compliance through your asset management or EDR tooling and formally close this vulnerability in your patch tracking system.

Google Chrome EUVD-2026-30426

| CVE-2026-8511 CRITICAL

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-5w85-m7vr-r7mx

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted-page delivery requires victim interaction (UI:R) with no privileges (PR:N); sandbox escape crosses a trust boundary (S:C) yielding full browser-process compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:51 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

9.6 (CRITICAL)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's UI layer, driven by a use-after-free (CWE-416) reachable before version 148.0.7778.168, lets a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox. Google rates the Chromium severity Critical and has shipped a fix; there is no public exploit identified at time of analysis, and EPSS is low (0.07%, 21st percentile), so this is a high-severity but not-yet-exploited memory-safety bug. SSVC lists exploitation as none with total technical impact.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Chrome's UI code - the browser-process-side chrome that manages windows, tabs and widgets rather than the sandboxed renderer. A UAF occurs when a heap object is freed but a dangling reference to it is later dereferenced, allowing an attacker who can control the reallocated memory to corrupt program state and hijack control flow. Because the buggy component lives in the higher-privileged browser/UI process, a successful exploit escapes the renderer sandbox, which is reflected in the CVSS scope-change (S:C). The single affected CPE is cpe:2.3:a:google:chrome, i.e. the Chrome desktop browser across platforms; Red Hat and SUSE tags indicate downstream Linux distribution rebuilds are also affected.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on all desktop platforms via the stable channel; Chrome normally auto-updates, so ensure the browser has been fully relaunched to apply the update and verify the version under chrome://settings/help. Users on Red Hat or SUSE builds should apply their distribution's corresponding Chromium update as it becomes available. Refer to Google's advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Because exploitation requires the victim to load attacker content, interim compensating controls if patching is delayed include restricting browsing to trusted sites, deploying web/URL filtering to block untrusted pages, and enforcing rapid update rollout via enterprise policy - but none of these substitute for the fix, and disabling browser features does not reliably prevent a UI-layer UAF, so upgrading is the only durable remediation.