What is the CVSS score of EUVD-2026-30447?

EUVD-2026-30447 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-30447?

Google Chrome's WebML component on Windows systems running versions prior to 148.0.7778.168 contains a heap buffer overflow enabling potential remote code execution when users visit a malicious…. A patch is available.

How to fix or mitigate EUVD-2026-30447?

Within 24 hours, use endpoint management tools to inventory systems running Google Chrome and identify those on versions prior to 148.0.7778.168. Within 7 days, deploy Chrome version 148.0.7778.168 or later across your organization via automatic updates or managed deployment mechanisms. Within 30 days, confirm patch deployment across at least 95% of Chrome installations and document completion in your security tracking system.

Google Chrome EUVD-2026-30447

| CVE-2026-8531 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-14 Chrome

GHSA-chj4-28rg-g73v

Buffer Overflow Google Heap Overflow Microsoft

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges but requires a user visit (UI:R); renderer-confined memory corruption gives high CIA with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:41 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in Google Chrome's WebML component on Windows lets a remote attacker trigger heap corruption-and potentially achieve code execution in the renderer-by luring a victim to a crafted HTML page in a version prior to 148.0.7778.168. Chromium rates the flaw High severity, and a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.06%).

Technical ContextAI

WebML is Chrome's in-browser machine-learning inference subsystem, which parses and executes model/tensor data supplied by web content. The root cause is CWE-122 (heap-based buffer overflow): attacker-influenced input (likely tensor dimensions, buffer sizes, or serialized model structures) is written past the bounds of a heap allocation, corrupting adjacent heap metadata or objects. Because this executes inside the renderer process, successful heap grooming can lead to memory disclosure or control-flow hijack, though Chrome's sandbox still stands between the renderer and the OS. The single CPE, cpe:2.3:a:google:chrome:*, confirms the affected product is the Chrome desktop browser (Windows builds specifically called out).

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on Windows via the Stable channel; restart the browser to apply the update, since Chrome stages updates but only activates them on relaunch (per https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html). Organizations managing Chrome via policy should push the update through their software-deployment tooling and verify the running build. If immediate patching is not possible, the practical compensating control is to reduce exposure to untrusted web content-restrict browsing to trusted sites and consider enterprise policies that limit navigation-accepting the usability trade-off; there is no feature-level toggle documented to disable WebML alone, so patching is the reliable fix. Chromium-based downstream builds from Red Hat and SUSE should be updated to their corresponding fixed packages as they ship.