What is the CVSS score of EUVD-2026-34417?

EUVD-2026-34417 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-34417?

Google Chrome on Windows running versions prior to 149.0.7827.53 contains a cross-origin data disclosure vulnerability that could expose sensitive user data across browser origins if attackers first…. A patch is available.

How to fix or mitigate EUVD-2026-34417?

24 hours: Deploy notification to users to avoid untrusted sites; inventory Windows machines running Chrome < 149.0.7827.53. 7 days: Stage and validate Chrome 149.0.7827.53 or later in testing environment. 30 days: Mandate update to Chrome 149.0.7827.53 or later across all Windows endpoints via MDM, Group Policy, or browser auto-update.

Google Chrome EUVD-2026-34417

| CVE-2026-10968 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-55cp-fwh4-vq8q

Information Disclosure Google Microsoft

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

SUSE

HIGH

qualitative

Red Hat

6.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:38 vuln.today

CVSS changed

Jun 05, 2026 - 20:37 NVD

7.4 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 7.4

DescriptionNVD

Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data disclosure in Google Chrome on Windows prior to 149.0.7827.53 allows remote attackers who have already compromised the renderer process to leak data from other origins via a crafted HTML page in the Dawn (WebGPU) component. Google rates the underlying issue High severity, but no public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.05%.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU standard, providing low-level GPU access to web content and translating WebGPU calls into native graphics APIs (Direct3D on Windows, Metal, Vulkan). The CWE-20 (Improper Input Validation) root cause indicates Dawn failed to sufficiently validate untrusted input - likely WebGPU command parameters or shader-related data - supplied through a crafted HTML page. Because the CVSS scope is Changed (S:C) with confidentiality high (C:H) and integrity/availability none, the flaw permits a sandboxed renderer to read memory or resources belonging to a different security context, breaking Chrome's same-origin and site-isolation boundaries. The CPE confirms the affected product is google:chrome across versions prior to the fix, and the description explicitly scopes the impact to the Windows build.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade immediately via Chrome's built-in auto-update or by restarting the browser to apply the staged update, as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise deployments should push the update through Google Update for Enterprise, Microsoft Intune, or SCCM and verify the deployed build is at or above 149.0.7827.53. As an interim compensating control where patching cannot occur immediately, administrators can disable WebGPU by setting the WebGPU/WebGPUDeveloperFeatures Chrome enterprise policies to disabled or by launching with --disable-features=WebGPU; this neutralizes the vulnerable Dawn surface but will break legitimate WebGPU-dependent web applications including some 3D, ML inference, and graphics-intensive sites.