What is the CVSS score of EUVD-2026-30435?

EUVD-2026-30435 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-30435?

Google Chrome Tab Groups component contains a remote code execution vulnerability (CVE-2026-8521) affecting all versions prior to 148.0.7778.168, allowing attackers to execute arbitrary code through…. A patch is available.

How to fix or mitigate EUVD-2026-30435?

Within 24 hours, identify and document all Chrome installations across the organization and their current versions. Within 7 days, deploy Chrome version 148.0.7778.168 or later to all endpoints; prioritize systems in user-facing roles and administrative functions. Within 30 days, complete deployment verification through your endpoint management platform to confirm all Chrome instances are at or above version 148.0.7778.168, and generate a compliance report for the security team.

Google Chrome EUVD-2026-30435

| CVE-2026-8521 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-9mx2-vh7f-423c

RCE Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

A browser UAF realistically requires the victim to load malicious web content, so AV:N/UI:R with AC:H for the heap race; renderer-process code execution keeps S:U with full C/I/A impact - this diverges from Google's AV:A/UI:N.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:47 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome's Tab Groups component (versions prior to 148.0.7778.168) stems from a use-after-free (CWE-416) that a remote attacker can trigger via malicious network traffic, per Google's Chrome Releases advisory rated Chromium-Critical. Successful exploitation yields arbitrary code execution in the affected browser process with total technical impact. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 10th percentile), and CISA SSVC records exploitation status as none.

Technical ContextAI

The flaw lives in Chrome's Tab Groups feature, part of the Chromium browser UI/tab-management layer. CWE-416 (Use After Free) means the code continues to reference a memory object after it has been freed; an attacker who controls the timing and reallocation of that freed region can corrupt heap memory and steer control flow toward attacker-supplied code. The single affected CPE is cpe:2.3:a:google:chrome (all versions up to the fix), and this class of bug - memory corruption reachable from processed content - is the dominant vulnerability pattern in Chromium's C++ codebase. The tags corroborate the impact profile: Use After Free, Memory Corruption, Denial Of Service, and RCE. Red Hat and SUSE tags indicate downstream Chromium/Chrome packages in those Linux distributions inherit the issue.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later, which Chrome applies automatically on restart; force the update by opening chrome://settings/help and relaunching, then confirm the version. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Enterprises managing Chrome via policy should push the pinned version through their update infrastructure (Google Update/Omaha, or distro package managers for Red Hat and SUSE Chromium builds). As an interim compensating control until the update lands, restrict exposure to untrusted web content and consider enforcing strict site isolation; there is no vendor-documented toggle to disable Tab Groups as a targeted workaround, so patching is the only reliable remediation, and the main trade-off of the interim controls is reduced browsing convenience rather than closing the bug.