What is the CVSS score of EUVD-2026-33155?

EUVD-2026-33155 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-33155?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability that allows attackers to execute arbitrary code within the browser renderer if a user visits a malicious…. A patch is available.

How to fix or mitigate EUVD-2026-33155?

Within 24 hours: Issue security alert to employees advising immediate browser updates; verify patch deployment capability in your environment. Within 7 days: Deploy Chrome 148.0.7778.216 or later across all endpoints using your standard patch management process. Within 30 days: Confirm 100% compliance through endpoint management tools and disable or restrict WebCodecs at the group policy level if your business does not require it.

Google Chrome EUVD-2026-33155

| CVE-2026-10013 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-xf9g-pxhx-jg8c

Use After Free RCE Memory Corruption Google Denial Of Service Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:23 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 stems from a use-after-free flaw in the WebCodecs component, allowing a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a malicious HTML page. The issue is rated High severity by Chromium with a CVSS 3.1 score of 8.8, and a vendor patch is available, though no public exploit has been identified at time of analysis and the CVE is not currently listed in CISA KEV. Successful exploitation requires user interaction (visiting a crafted page), and code execution is constrained to the Chrome sandbox unless chained with a sandbox-escape bug.

Technical ContextAI

WebCodecs is a low-level browser API that gives JavaScript direct access to audio and video encoders and decoders, exposing components such as VideoDecoder, AudioDecoder, VideoEncoder, and AudioEncoder that bridge web content to Chromium's media pipeline. The root cause is CWE-416 (Use After Free), a memory-safety class in which an object is freed while a pointer or reference to it remains in use; a subsequent access reads or writes the freed allocation, often allowing attackers to influence the contents through heap-grooming and obtain arbitrary read/write or control of a function pointer. In WebCodecs specifically, lifetime management between JavaScript-exposed objects and the underlying C++ codec state is intricate, and the affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates desktop Chrome builds prior to the fixed 148.0.7778.216 release on the stable channel.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 on the stable desktop channel - install the update via Chrome's built-in updater or by relaunching the browser, and verify the version under chrome://settings/help, with managed fleets using policies such as TargetVersionPrefix or MSI/PKG distribution to force the rollout, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Administrators of Chromium-based browsers should track their respective vendor advisories and update once the upstream fix is merged, and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-10013 plus EUVD-2026-33155 should be used for vulnerability-management tracking. If immediate patching is not feasible, compensating controls include disabling WebCodecs in enterprise managed profiles where supported, restricting browsing to trusted sites via URLBlocklist/URLAllowlist policies, enabling Site Isolation (already on by default) and Enhanced Safe Browsing, and using application-layer egress filtering to block known malicious infrastructure; note that blocking WebCodecs will break modern video-conferencing and streaming web apps that rely on it, and allowlisting carries the usual productivity trade-offs.