What is the CVSS score of EUVD-2026-33075?

EUVD-2026-33075 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33075?

A use-after-free vulnerability in Google Chrome could enable attackers to compromise employee systems through malicious webpages, creating direct risk to endpoints across the organization.. A patch is available.

How to fix or mitigate EUVD-2026-33075?

24 hours: Verify Chrome 148.0.7778.216 or later availability; test patch in development environment; notify all users of mandatory update requirement. 7 days: Deploy patched version to testing cohorts; validate functionality across business-critical web applications. 30 days: Complete rollout of Chrome 148.0.7778.216+ to all organizational endpoints; confirm 100% compliance via browser telemetry.

Google Chrome EUVD-2026-33075

| CVE-2026-9933 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-m33f-x3vc-mphw

Google Use After Free Denial Of Service Memory Corruption Red Hat Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:22 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.5

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in the Input component of Google Chrome prior to 148.0.7778.216 allows a remote attacker to trigger heap corruption when a victim is lured to a crafted HTML page and performs specific UI gestures. Chromium rates the severity High, and while no public exploit identified at time of analysis and EPSS is very low (0.03%, 11th percentile), the bug class historically yields renderer RCE when chained with a sandbox escape. A vendor patch is available in the stable channel update referenced by Google.

Technical ContextAI

The flaw resides in Chrome's Input subsystem (cpe:2.3:a:google:chrome), which handles user input events such as pointer, keyboard, and gesture dispatch within the Blink/renderer process. CWE-416 (Use After Free) means an object is referenced after its memory has been freed, allowing an attacker who can influence heap layout to reclaim the slot with controlled data and hijack subsequent virtual calls or field accesses, yielding heap corruption and potential type confusion. Because Input runs inside the sandboxed renderer, raw exploitation typically achieves code execution within the renderer's address space; full system compromise generally requires an additional sandbox-escape primitive.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.216 or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and force a browser relaunch so the patched renderer binary is loaded. For managed fleets, push the update through Chrome Browser Cloud Management or your endpoint management tool and verify via chrome://version. Downstream Chromium-based browsers should be updated as soon as their vendors ship a corresponding build (see NVD reference https://nvd.nist.gov/vuln/detail/CVE-2026-9933). As a compensating control until patching completes, deploy site-isolation policies (already default) and restrict browsing to trusted sites via URL allowlists for high-risk users; disabling JavaScript on untrusted origins via the SiteList policy reduces the heap-grooming surface but breaks most modern web apps, so scope this to kiosk/admin workstations only.