What is the CVSS score of EUVD-2026-30459?

EUVD-2026-30459 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-30459?

A use-after-free vulnerability in Google Chrome's Media component (CVE-2026-8544, CVSS 8.8) exposes organizations to remote code execution if users visit malicious websites before updating to version…. A patch is available.

How to fix or mitigate EUVD-2026-30459?

Immediately initiate a vulnerability assessment to identify all Chrome installations prior to 148.0.7778.168 and notify affected users within 24 hours. Within 7 days, deploy Chrome version 148.0.7778.168 through your standard patch management process, prioritizing internet-facing workstations and high-risk corporate systems. Complete verification of patch deployment across all managed endpoints within 30 days.

Google Chrome EUVD-2026-30459

| CVE-2026-8544 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-hh3h-hx57-wxhf

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via crafted page (AV:N/AC:L/PR:N) needing a victim visit (UI:R); renderer code execution yields high C/I/A but remains sandbox-confined, so no scope change (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:26 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Media component (versions prior to 148.0.7778.168) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8; no public exploit identified at time of analysis, and SSVC records no observed exploitation with a low EPSS of 0.08%. Exploitation requires user interaction (visiting a malicious page) and, because code runs inside the sandbox, a separate sandbox-escape bug would be needed for full host compromise.

Technical ContextAI

The vulnerability resides in Chrome's Media subsystem, the component responsible for decoding and rendering audio/video content (e.g., MSE/HTMLMediaElement pipelines) built on the Chromium/Blink engine. The root cause is CWE-416 Use-After-Free: an object is freed while a reference to it remains reachable, so subsequent access operates on reclaimed memory whose contents an attacker can groom to control execution flow. Because media parsing is driven by attacker-supplied content in a web page, a crafted media stream can trigger the dangling-pointer condition and corrupt heap state in the renderer process. The single affected CPE is cpe:2.3:a:google:chrome:*, covering the Chrome desktop browser prior to 148.0.7778.168.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.168 - update to this version or later via the Chrome Stable channel and relaunch the browser to apply the fix (see https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html). Users of Chromium-based distributions from Red Hat or SUSE should apply their respective updated packages once released. No effective configuration workaround eliminates the flaw since it triggers on media content in ordinary web pages; if immediate patching is not possible, compensating controls include enforcing Chrome's automatic-update mechanism, restricting browsing to trusted sites via web filtering/proxy policies, and enabling stricter site isolation - with the trade-off that these reduce but do not remove exposure. Disabling media playback is generally impractical and would break legitimate functionality.