What is the CVSS score of EUVD-2026-34422?

EUVD-2026-34422 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 1.6%.

Which versions of Google Chrome are affected by EUVD-2026-34422?

Google Chrome prior to version 149.0.7827.53 contains a cross-origin data leakage vulnerability in the WebGPU implementation that could expose sensitive user data when a user visits a malicious…. A patch is available.

How to fix or mitigate EUVD-2026-34422?

Within 24 hours: Identify all Chrome deployments across the organization and establish an emergency patching timeline. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later to all systems, prioritizing user-facing machines and administrative workstations. Within 30 days: Verify 100% compliance with minimum version 149.0.7827.53, conduct spot audits of deployed versions, and document remediation completion.

Google Chrome EUVD-2026-34422

| CVE-2026-10973 HIGH

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-5q46-3pcm-3mxv

Information Disclosure Google

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

SUSE

HIGH

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:40 vuln.today

CVSS changed

Jun 05, 2026 - 20:37 NVD

7.4 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 7.4

DescriptionNVD

Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's Dawn WebGPU implementation prior to version 149.0.7827.53 allows a remote attacker to read sensitive data from other origins by luring a user to a crafted HTML page. Chromium rates this High severity and a vendor patch is available, though no public exploit has been identified at time of analysis and EPSS places exploitation probability at 1.64% (82nd percentile).

Technical ContextAI

Dawn is Chromium's open-source, cross-platform implementation of the WebGPU API, which exposes GPU compute and rendering capabilities to web content through a JavaScript interface. The root cause is CWE-457 (Use of Uninitialized Variable): a code path inside Dawn reads memory that was never initialized, allowing residual contents - potentially populated by data from other origins or processes - to be returned to the attacker-controlled page. Because WebGPU operates close to the GPU driver and shares GPU memory across browser tabs and renderers, uninitialized reads here are especially dangerous for breaking the same-origin policy. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Chrome desktop builds preceding 149.0.7827.53.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later on all desktop platforms, as documented in the Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For managed fleets, push the update via Chrome Browser Cloud Management or your endpoint management tooling and verify chrome://settings/help reports the fixed build; ensure downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) are upgraded to releases that incorporate the Dawn fix. If immediate patching is not possible, a targeted compensating control is to disable WebGPU by launching Chrome with --disable-features=WebGPU or via enterprise policy, which closes the affected Dawn attack surface at the cost of breaking WebGPU-dependent sites and applications (rare today, more common for ML demos and some games); blocking known malicious domains at the proxy layer is a weaker secondary mitigation since exploitation only requires visiting attacker-controlled HTML.