What is the CVSS score of EUVD-2026-30437?

EUVD-2026-30437 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-30437?

Google Chrome versions before 148.0.7778.168 contain a remote code execution vulnerability in the Fonts component that allows attackers to execute arbitrary code within the browser sandbox when users…. A patch is available.

How to fix or mitigate EUVD-2026-30437?

Within 24 hours, inventory your Chrome deployment method and initiate emergency patching to version 148.0.7778.168, prioritizing systems with elevated data access. Within 7 days, complete deployment of version 148.0.7778.168 across all endpoint Chrome installations through your standard patch management or MDM process. Within 30 days, validate successful patch deployment across your environment, reinforce security controls to restrict access to untrusted websites, and establish monitoring for exploitation indicators.

Google Chrome EUVD-2026-30437

| CVE-2026-8558 HIGH

Out-of-bounds Write (CWE-787)

2026-05-14 Chrome

GHSA-7m72-mq6q-p26x

RCE Buffer Overflow Google Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no auth (AV:N/PR:N) but victim must open it (UI:R); code runs only in the renderer sandbox so scope unchanged (S:U) with high C/I/A within the component.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:45 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Renderer-sandboxed remote code execution in Google Chrome's Fonts component (versions prior to 148.0.7778.168) lets a remote attacker run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw is a CWE-787 out-of-bounds write reported internally by the Chrome team. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile), consistent with the CISA SSVC assessment of no known exploitation.

Technical ContextAI

The vulnerability lives in Chrome's font-handling code, part of the Blink rendering engine that parses and rasterizes font data (e.g., glyph tables from web fonts or system fonts referenced by a page). The root cause is CWE-787, an out-of-bounds write, where malformed font structures cause the parser to write past an allocated buffer, corrupting adjacent heap memory. Because font parsing runs inside the renderer process, successful memory corruption yields code execution confined to that sandboxed process rather than the host OS. The single affected product per CPE is cpe:2.3:a:google:chrome (all versions below the fix), and the Blink font stack is shared across Chromium-based downstreams.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later (Stable channel), per the Chrome release blog https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html; restart the browser to apply the update since Chrome patches only take effect after relaunch. For managed fleets, push the update via enterprise policy and verify the version at chrome://settings/help. Chromium-based and repackaged builds (e.g., Red Hat, SUSE) should be upgraded to their vendor release that incorporates the fixed Chromium version. As interim compensating controls until updates roll out, reduce exposure to untrusted pages by enabling Enhanced Safe Browsing and, in high-security environments, deploying site isolation and restricting web-font/JavaScript execution on untrusted origins - noting the trade-off that aggressively blocking web fonts or scripting degrades rendering and breaks many legitimate sites.