What is the CVSS score of EUVD-2026-34384?

EUVD-2026-34384 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-34384?

Google Chrome prior to version 149.0.7827.53 is vulnerable to remote code execution attacks that can compromise any user's endpoint through a malicious webpage visit.. A patch is available.

How to fix or mitigate EUVD-2026-34384?

Within 24 hours: Audit current Chrome versions deployed across the enterprise and identify non-compliant systems. Within 7 days: Push Chrome version 149.0.7827.53 or later to all endpoints via endpoint management tools or browser distribution channels. Within 30 days: Verify 100% deployment completion and review access logs for any exploitation attempts against older Chrome versions.

Google Chrome EUVD-2026-34384

| CVE-2026-10935 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-04 chrome-cve-admin@google.com

GHSA-c87g-9rmq-c4m3

RCE Google Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:43 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome V8 JavaScript engine prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the renderer sandbox by serving a crafted HTML page to a victim. The flaw is a type confusion bug (CWE-843) in V8 rated High severity by Chromium, with no public exploit identified at time of analysis and SSVC indicating exploitation status 'none' from CISA's framework.

Technical ContextAI

V8 is the open-source JavaScript and WebAssembly engine that powers Chrome, Edge, Opera, and other Chromium-derived browsers, as well as Node.js. CWE-843 (Type Confusion) occurs when code allocates or accesses a resource using one type but later interprets it as an incompatible type, which in a JIT-compiling engine like V8 typically leads to memory corruption because object layouts and inline-cache assumptions diverge from reality. Affected CPE coverage per ENISA EUVD is Chrome builds below 149.0.7827.53; while Chrome itself is the named product, downstream Chromium-based browsers and any Electron/CEF applications embedding the same V8 build are likely impacted until they rebase.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Chrome Stable to this version or later via the built-in updater (Help > About Google Chrome) and restart the browser to load the patched V8, per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprises managing Chrome via policy should force-push the update and confirm with chrome://version on endpoints; downstream Chromium browsers should be updated as soon as their vendors ship a rebased build. As a temporary compensating control where patching is delayed, restrict browsing to trusted sites via enterprise URL allowlists, enable Site Isolation (default on desktop) to keep the renderer compromise contained, and consider disabling JIT in V8 via the --js-flags='--jitless' command-line switch or the JavaScriptJitlessIsAllowed enterprise policy where supported - note this materially degrades JavaScript performance and may break complex web apps.