What is the CVSS score of EUVD-2026-34372?

EUVD-2026-34372 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-34372?

Google Chrome for Android contains a remote-code-execution vulnerability (CVE-2026-10923, CVSS 8.8) in versions prior to 149.0.7827.53 affecting file handling; no public exploit identified at time of…. A patch is available.

How to fix or mitigate EUVD-2026-34372?

Within 24 hours: Inventory Chrome for Android devices in use and notify users. Within 7 days: Deploy vendor-released patch (Chrome 149.0.7827.53 or later) via mobile device management or enable auto-update. Within 30 days: Audit deployment completion and monitor endpoint telemetry for exploitation indicators.

Google Chrome EUVD-2026-34372

| CVE-2026-10923 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-936p-3q7j-gg72

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 22:30 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.8 (HIGH)

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: High)

AnalysisAI

Arbitrary code execution in Google Chrome for Android prior to 149.0.7827.53 stems from a use-after-free flaw in the WebAppInstalls component, triggered when a victim opens a malicious file. Although the CVSS vector lists a network attack vector with high impact across confidentiality, integrity, and availability, exploitation requires user interaction and no public exploit identified at time of analysis. EPSS probability is very low (0.01%) and SSVC indicates no observed exploitation, suggesting the immediate threat is limited despite the High severity rating from Chromium.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in the WebAppInstalls subsystem of Chromium, which handles Progressive Web App (PWA) installation and management on Android. Use-after-free vulnerabilities occur when memory is freed while still being referenced, allowing an attacker to reclaim that memory with attacker-controlled data and hijack control flow when the dangling pointer is dereferenced. Because Chrome on Android uses a multi-process sandbox architecture, exploitation of a renderer-side UAF typically yields code execution within the sandboxed renderer or browser process tied to the WebAppInstalls path, and would normally need to be chained with a sandbox escape for full device compromise.

RemediationAI

Upgrade Google Chrome on Android to version 149.0.7827.53 or later, which is the vendor-released patch referenced in the Chrome Releases stable channel update at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked in Chromium issue https://issues.chromium.org/issues/499423683. On managed Android fleets, push the update via MDM or Google Play managed configurations to enforce the minimum version. Until the patched build rolls out, reduce exposure by disabling or restricting Progressive Web App installation prompts through enterprise policy (which removes PWA install functionality for users), avoiding opening untrusted files in the browser, and instructing users not to install PWAs or open links from unknown sources - the trade-off is reduced PWA usability for legitimate web apps.