What is the CVSS score of EUVD-2026-34459?

EUVD-2026-34459 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-34459?

Google Chrome on Android (versions prior to 149.0.7827.53) contains a sandbox escape vulnerability that allows attackers to execute code outside the browser sandbox if the renderer process is already…. A patch is available.

How to fix or mitigate EUVD-2026-34459?

Within 24 hours: Announce Chrome 149.0.7827.53+ availability to all Android device users and administrators; verify MDM/push deployment capability is functional. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all managed Android devices via mobile device management platform. Within 30 days: Audit deployment completion; confirm no devices remain on vulnerable versions through inventory scans.

Google Chrome EUVD-2026-34459

| CVE-2026-11010 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-c8ph-8mmv-92v8

Denial Of Service Use After Free Memory Corruption Google Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 18:23 vuln.today

CVSS changed

Jun 06, 2026 - 18:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in WebShare in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows remote attackers who have already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a use-after-free in the WebShare component. The flaw requires a pre-existing renderer compromise plus user interaction, and no public exploit identified at time of analysis, though Chromium-rated Medium severity and the patch availability suggest defenders should treat it as part of the standard Chrome update cycle.

Technical ContextAI

The vulnerability resides in the WebShare implementation within Chromium's Android port, which exposes the navigator.share() Web API to bridge web content with native Android share-sheet intents. The root cause is CWE-416 (Use After Free): a memory object backing a WebShare operation is freed while a dangling reference is still reachable, allowing the attacker to reuse the freed allocation with controlled data. Because WebShare brokers communication between the renderer process and higher-privileged browser/Android system components, corrupting its state from a compromised renderer can be leveraged to cross the sandbox boundary. The affected CPE family is Google Chrome for Android up to but not including 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome for Android 149.0.7827.53 or later - update via Google Play Store or device-managed app distribution as soon as the build reaches your channel, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. There is no documented runtime workaround for the WebShare UAF itself; until updates are deployed, compensating controls include restricting installation of untrusted apps and discouraging users from interacting with share prompts on unknown sites, and for managed fleets, using Chrome Enterprise / Android Management policies to enforce minimum Chrome versions and to disable WebShare-related permissions where feasible (trade-off: breaks legitimate share workflows in web apps). Mobile EDR/MTD products can flag outdated Chrome versions as an additional detection layer.