What is the CVSS score of EUVD-2026-30456?

EUVD-2026-30456 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-30456?

Google Chrome on Windows before version 148.0.7778.168 contains a sandbox escape vulnerability (CVE-2026-8542) that allows attackers who have already compromised the browser renderer process to…. A patch is available.

How to fix or mitigate EUVD-2026-30456?

Within 24 hours, deploy Chrome version 148.0.7778.168 or later to pilot systems and verify compatibility with line-of-business applications; simultaneously identify your Windows endpoint count running Chrome. Within 7 days, push the patch to all corporate Windows devices via your enterprise patch management system, prioritizing managed endpoints first and enabling automatic updates if not already configured. Within 30 days, confirm patch adoption across 100% of Windows systems, audit Chrome version compliance through your endpoint management tool, and document any remediation blockers.

Google Chrome EUVD-2026-30456

| CVE-2026-8542 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-hpgj-jh3h-gjmr

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Delivered over the network via crafted HTML (AV:N) needing victim page load (UI:R); heap UAF is non-deterministic (AC:H); sandbox escape crosses a trust boundary (S:C) with full host impact (C/I/A:H); PR:N per Chrome scoring convention though renderer compromise is a practical precondition.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:27 vuln.today

CVSS changed

May 14, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows before 148.0.7778.168 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain code execution at higher privilege on the host. The flaw is a use-after-free (CWE-416) in Chrome's Core component, triggered via a crafted HTML page; Google rates it High severity. No public exploit has been identified at time of analysis, and EPSS is very low (0.07%, 21st percentile), consistent with an internally reported bug not yet weaponized.

Technical ContextAI

The defect is a use-after-free (CWE-416) in the 'Core' subsystem of Chromium, the open-source engine underpinning Google Chrome (CPE cpe:2.3:a:google:chrome). Use-after-free occurs when a pointer to heap memory is retained and dereferenced after that memory has been freed, allowing an attacker who controls heap layout to reclaim the freed allocation with attacker-shaped data and hijack the resulting object usage (e.g., vtable or callback pointers). Because Chrome isolates web content in a low-privilege renderer sandbox, this class of bug is used as the second stage of an exploit chain: the attacker first achieves execution inside the renderer, then leverages this UAF to corrupt memory in a more privileged process context and escape the sandbox onto the host.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on Windows via the Chrome stable channel update (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); restart the browser to complete the update since Chrome applies patches only after relaunch. Downstream Chromium-based distributions (Red Hat, SUSE) should track their vendor advisories for the corresponding rebuilt package. If immediate patching is not possible, compensating controls include enforcing Chrome's site isolation (default on) and strict sandbox settings, deploying enterprise policy to force auto-update and disable update deferral, and restricting users from browsing untrusted sites - with the trade-off that browsing restrictions impede normal work and do not eliminate risk from a compromised renderer. There is no configuration toggle that specifically disables the vulnerable Core code path, so upgrading is the only complete fix.