What is the CVSS score of EUVD-2026-34391?

EUVD-2026-34391 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-34391?

Google Chrome on Windows versions prior to 149.0.7827.53 contain a local privilege escalation vulnerability that could enable attackers delivering malicious files to gain administrative control of…. A patch is available.

How to fix or mitigate EUVD-2026-34391?

Within 24 hours: Audit Chrome deployment across Windows systems and identify users on versions prior to 149.0.7827.53. Within 7 days: Deploy Chrome 149.0.7827.53 or later via standard update mechanisms (Group Policy, Intune, or native auto-update) and verify rollout to 95%+ of endpoints. Within 30 days: Achieve 100% compliance via enforcement and audit; implement email gateway filtering for suspicious file attachments as a compensating layer.

Google Chrome EUVD-2026-34391

| CVE-2026-10942 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-fjjw-c73h-35f8

Google Microsoft Privilege Escalation Chrome

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.3 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:46 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

7.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 7.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)

AnalysisAI

Local privilege escalation in Google Chrome on Windows prior to 149.0.7827.53 enables an attacker who can deliver a malicious file to a victim to elevate privileges via an inappropriate UI implementation. Google's Chromium team rated the severity as High and a stable channel patch has been released, but no public exploit has been identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

The flaw resides in Chrome's UI subsystem on the Windows platform and is classified under CWE-20 (Improper Input Validation), indicating that the browser's user-interface code accepts or processes file-related input without adequately validating it before performing a security-sensitive action. Because the affected component is the user-facing UI layer rather than the renderer sandbox or V8 engine, the weakness likely involves how Chrome handles file paths, file types, or shell interactions when the user interacts with a crafted file - a class of bug that has historically allowed attackers to abuse default file handlers, drag-and-drop, or download dialogs on Windows. The CPE is not provided in the input, but the EUVD record narrows the affected scope to Chrome builds prior to 149.0.7827.53 on Windows.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade all Windows endpoints to this stable build or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, restarting the browser to apply the update. Enterprise administrators should push the update through Google Update / Chrome Browser Cloud Management or their endpoint management tooling and verify versions via chrome://settings/help. Until the patched build is deployed, compensating controls include restricting users from opening untrusted downloaded files (e.g., enforcing SmartScreen and Mark-of-the-Web prompts, blocking executable downloads at the proxy, and disallowing risky file extensions via AppLocker/WDAC) - note these controls reduce but do not eliminate exposure because the vulnerability is reached through normal file-handling UI flows and may degrade legitimate user workflows.