What is the CVSS score of EUVD-2026-30469?

EUVD-2026-30469 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-30469?

Google Chrome desktop contains a privilege escalation flaw (CVE-2026-8557) affecting all versions before 148.0.7778.168 that allows attackers to escape the browser sandbox if they have already…. A patch is available.

How to fix or mitigate EUVD-2026-30469?

Within 24 hours, validate patch availability and test Chrome 148.0.7778.168 in a pilot deployment on 10-20 test systems to ensure compatibility with line-of-business applications and enterprise configurations. Within 7 days, roll out the patch to all Chrome installations organization-wide via your endpoint management system (e.g., Group Policy for Windows, configuration management for macOS/Linux), prioritizing systems with elevated privileges or access to sensitive data. Within 30 days, audit all systems to confirm 100% patching compliance and review logs for any suspicious Chrome process behavior indicating prior renderer compromise attempts.

Google Chrome EUVD-2026-30469

| CVE-2026-8557 HIGH

Use After Free (CWE-416)

2026-05-14 Chrome

GHSA-wh82-47gg-p482

Privilege Escalation Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a pre-compromised renderer (PR:L) and precise memory conditions (AC:H) plus loading crafted content (UI:R); escaping the renderer sandbox crosses a trust boundary (S:C) with full impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:19 vuln.today

CVSS changed

May 14, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

CVE Published

May 14, 2026 - 19:52 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Privilege escalation in Google Chrome desktop before 148.0.7778.168 lets an attacker who has already compromised the renderer process abuse a use-after-free in the Accessibility component to break out of the sandbox and gain elevated privileges via a crafted HTML page. Rated High by Chromium and scored CVSS 7.5, it is a second-stage exploit primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low at 0.07%.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Accessibility (a11y) subsystem, which builds and maintains the accessibility tree that mirrors the DOM for assistive technologies. Use-after-free occurs when a freed object's memory is later dereferenced, allowing an attacker to control the contents of the reclaimed allocation and hijack execution or corrupt state. Because the Accessibility engine partly operates in the higher-privileged browser process, a memory-corruption bug there is a classic vector for escaping the renderer sandbox. The affected product per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build), and Red Hat and SUSE tags indicate downstream redistribution in Linux Chromium/Chrome packages.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on all desktop platforms; Chrome typically auto-updates, so verify via chrome://settings/help and relaunch to apply. For managed fleets, push the updated build through enterprise deployment tooling, and for Linux users update the distribution-provided Chromium/Chrome packages once Red Hat and SUSE publish rebuilt versions. Because exploitation first requires a compromised renderer, keeping the site-isolation sandbox enabled (the default) and promptly applying all Chrome security updates that fix renderer-side bugs are the most effective compensating controls; disabling the sandbox or accessibility features is not recommended as a workaround since it degrades security or usability. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html.