What is the CVSS score of EUVD-2026-34391?

EUVD-2026-34391 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-34391?

Within 24 hours: Audit Chrome deployment across Windows systems and identify users on versions prior to 149.0.7827.53. Within 7 days: Deploy Chrome 149.0.7827.53 or later via standard update mechanisms (Group Policy, Intune, or native auto-update) and verify rollout to 95%+ of endpoints. Within 30 days: Achieve 100% compliance via enforcement and audit; implement email gateway filtering for suspicious file attachments as a compensating layer.

Google Chrome EUVD-2026-34391

Q: Which versions of Google Chrome are affected by EUVD-2026-34391?

Google Chrome on Windows versions prior to 149.0.7827.53 contain a local privilege escalation vulnerability that could enable attackers delivering malicious files to gain administrative control of…. A patch is available.

| CVE-2026-10942 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-fjjw-c73h-35f8

Privilege Escalation Google Microsoft

7.8

CVSS 3.1 · Vendor: google

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious file targeting Chrome UI
Delivery

Deliver file to Windows victim
Exploit

User opens file in Chrome
Execution

Trigger improper input validation in UI
Impact

Escalate privileges on local host

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Exploitation requires local presence on a Windows host running a vulnerable Chrome build (<149.0.7827.53) and user interaction with an attacker-supplied malicious file processed through Chrome's UI - per CVSS AV:L/UI:R, the attacker cannot trigger this purely over the network without the user opening or engaging with the crafted file. No prior authentication or special privileges in Chrome are required (PR:N), but the attack is limited to the Windows platform per the description, and macOS/Linux Chrome installations are not in scope. Scope is unchanged (S:U), meaning the elevation is bounded by the user's own context on the host rather than crossing a security boundary into another principal.
Impact	The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.8 and reflects a local attack vector requiring user interaction but no prior authentication, with high impact across confidentiality, integrity, and availability - consistent with a privilege escalation outcome on the victim's host. EPSS data is not provided, and the CVE is not on CISA KEV, so there is no confirmed widespread exploitation; combined with the lack of a public POC, real-world risk is currently moderate rather than urgent. The requirement for UI:R (user interaction with a malicious file) meaningfully limits opportunistic mass exploitation, but the High Chromium severity rating and Windows-only scope suggest this is a credible target for chained attacks (e.g., paired with a social-engineering or download-borne delivery), so patching should be prioritized on Windows endpoints even absent KEV listing.
Exploit ScenarioDerived	An attacker delivers a specially crafted file to a Windows user - for example via a phishing email link, drive-by download, or shared network folder - and convinces the user to open or interact with it through Chrome's UI. When Chrome processes the file through the vulnerable UI path, validation is bypassed and the attacker gains elevated privileges on the local host beyond what the browser process should normally allow; no public exploit identified at time of analysis, so a working POC would need to be developed.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 05, 2026

Local privilege escalation in Google Chrome on Windows prior to 149.0.7827.53 enables an attacker who can deliver a malicious file to a victim to elevate privileges via an inappropriate UI implementation. Google's Chromium team rated the severity as High and a stable channel patch has been released, but no public exploit has been identified at time of analysis and the issue is not currently listed in CISA KEV.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade all Windows endpoints to this stable build or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, restarting the browser to apply the update. Enterprise administrators should push the update through Google Update / Chrome Browser Cloud Management or their endpoint management tooling and verify versions via chrome://settings/help. Until the patched build is deployed, compensating controls include restricting users from opening untrusted downloaded files (e.g., enforcing SmartScreen and Mark-of-the-Web prompts, blocking executable downloads at the proxy, and disallowing risky file extensions via AppLocker/WDAC) - note these controls reduce but do not eliminate exposure because the vulnerability is reached through normal file-handling UI flows and may degrade legitimate user workflows.

Affected VersionsENISA

Chrome 149.0.7827.53 <149.0.7827.53

Affected Packages

euvd chrome fix: 149.0.7827.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw resides in Chrome's UI subsystem on the Windows platform and is classified under CWE-20 (Improper Input Validation), indicating that the browser's user-interface code accepts or processes file-related input without adequately validating it before performing a security-sensitive action. Because the affected component is the user-facing UI layer rather than the renderer sandbox or V8 engine, the weakness likely involves how Chrome handles file paths, file types, or shell interactions when the user interacts with a crafted file - a class of bug that has historically allowed attackers to abuse default file handlers, drag-and-drop, or download dialogs on Windows. The CPE is not provided in the input, but the EUVD record narrows the affected scope to Chrome builds prior to 149.0.7827.53 on Windows.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (google) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 7.3 HIGH

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jun 05, 2026 - 02:22 NVD

7.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)

Executive ViewAI

Why It Matters

Google Chrome on Windows versions prior to 149.0.7827.53 contain a local privilege escalation vulnerability that could enable attackers delivering malicious files to gain administrative control of affected systems. No active exploitation has been observed, but the vulnerability is trivial to trigger through social engineering or phishing, creating a meaningful attack surface across the organization's Windows user base. Immediate patching is required to close this elevated-privilege access path.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 99% exploitable

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.