What is the CVSS score of EUVD-2026-30439?

EUVD-2026-30439 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-30439?

Google Chrome contains a critical remote code execution vulnerability affecting all employees using the browser.. A patch is available.

How to fix or mitigate EUVD-2026-30439?

Within 24 hours: Issue mandatory security notification requiring all employees to update Chrome to version 148.0.7778.168 and provide download instructions if self-service updates are not enforced. Within 7 days: Deploy the patch via endpoint management tools to all workstations and laptops, and configure policies to block older Chrome versions from executing. Within 30 days: Run a compliance audit to verify 100% of devices run Chrome 148.0.7778.168 or later; prioritize re-enforcement and manual updates on any non-compliant systems.

Google Chrome EUVD-2026-30439

| CVE-2026-8527 HIGH

Improper Input Validation (CWE-20)

2026-05-14 Chrome

GHSA-hj4x-332r-qxhv

RCE Google

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via a crafted page with low complexity and no auth, but requires the victim to open the page (UI:R); successful exploitation yields full code execution, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:42 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Downloads component before version 148.0.7778.168 allows a remote attacker to execute arbitrary code when a victim visits or interacts with a crafted HTML page. Chromium rates this High severity, and the CVSS 8.8 vector confirms the flaw is network-reachable and unauthenticated but requires user interaction (UI:R). There is no public exploit identified at time of analysis, and EPSS is low (0.08%), consistent with CISA SSVC marking exploitation status as none.

Technical ContextAI

The vulnerability sits in Chrome's Downloads subsystem, the browser component responsible for handling file-download requests, metadata, and destination handling triggered by web content. The root cause is classed as CWE-20 (Improper Input Validation): the Downloads code insufficiently validates untrusted input originating from a crafted HTML page, which can be leveraged to corrupt program state and reach an arbitrary-code-execution condition inside the renderer/browser process. The affected CPE is cpe:2.3:a:google:chrome:*, covering desktop Chrome builds; because Chromium is the upstream engine, downstream redistributors (Red Hat, SUSE - reflected in the tags) ship parallel fixes. Scope is Unchanged (S:U), indicating impact is contained within the browser's own security context rather than crossing into the host OS sandbox boundary directly.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later via the Stable Channel; on most installs this arrives automatically, so trigger and confirm the update by opening chrome://settings/help and relaunching the browser. Enterprise fleets should push the fixed build through their existing update/management tooling and verify version compliance. For Chromium-based distributions, apply the corresponding Red Hat and SUSE package updates as they are released. No supported workaround fully substitutes for the patch; because the attack requires opening a crafted page, interim compensating controls include restricting browsing to trusted sites, enforcing strict download policies, and keeping the browser sandbox enabled - these reduce but do not eliminate exposure. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html.