What is the CVSS score of EUVD-2026-30465?

EUVD-2026-30465 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-30465?

Google Chrome's media rendering engine contains a critical remote code execution vulnerability (CVE-2026-8549, CVSS 8.8) that could allow attackers to compromise employee devices and steal sensitive…. A patch is available.

How to fix or mitigate EUVD-2026-30465?

Within 24 hours, force immediate deployment of Google Chrome version 148.0.7778.168 or later through centralized MDM/policy controls to all endpoints, prioritizing systems with access to sensitive data. Within 7 days, conduct a comprehensive compliance scan to verify patch adoption and remediate any non-compliant installations. Within 30 days, reinforce browser isolation controls, configure website content filtering for high-risk categories, and distribute employee training on malware delivery tactics and safe browsing practices.

Google Chrome EUVD-2026-30465

| CVE-2026-8549 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-6fqp-88f8-7477

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges (PR:N) but requires the victim to open it (UI:R); code runs in the renderer sandbox so no scope change (S:U) with high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:24 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

8.8 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Media component (versions prior to 148.0.7778.168) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw is a use-after-free (CWE-416); Google has shipped a fixed Stable channel build. There is no public exploit identified at time of analysis, EPSS is low (0.08%), and CISA SSVC records exploitation as none - though memory-corruption bugs in Chrome's media stack are historically attractive to attackers.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) in Chrome's Media subsystem - the pipeline that decodes and renders audio/video content delivered to the browser. A use-after-free occurs when memory is freed but a dangling pointer is later dereferenced, letting an attacker reclaim the freed allocation with controlled data and hijack execution flow. The affected component is reachable from untrusted web content, so a malicious page can drive the media code paths to trigger the condition. Per the CPE data (cpe:2.3:a:google:chrome:*), all Chrome branches before 148.0.7778.168 on the desktop Stable channel are impacted; because Chromium is the shared base for Edge, Brave, Opera and others, downstream browsers may inherit the same defect until they rebase.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on the Stable desktop channel via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html - restart the browser to complete the update, as Chrome fetches the fix in the background but only applies it on relaunch. Enterprises managing Chrome via policy should confirm the auto-update rollout has reached endpoints and force the update where deployment is pinned. Red Hat and SUSE users should apply the corresponding distribution package updates for their Chromium builds. If immediate patching is not possible, reduce exposure by restricting browsing of untrusted sites and, as a targeted compensating control, disabling or restricting media autoplay and untrusted media playback lowers the chance of silently triggering the vulnerable code path - with the trade-off of degraded audio/video functionality on legitimate sites; the renderer sandbox itself already limits impact and should be left enabled.