What is the CVSS score of EUVD-2026-34533?

EUVD-2026-34533 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-34533?

Google Chrome for Android versions prior to 149.0.7827.53 contain a critical memory corruption vulnerability (CVSS 8.8) exploitable through malicious web content.. A patch is available.

How to fix or mitigate EUVD-2026-34533?

Within 24 hours: Inventory all Android devices with Google Chrome installed; identify those running versions before 149.0.7827.53 and notify users of patch availability. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later across all Android devices via MDM, prioritizing devices with administrative privileges or handling sensitive data. Within 30 days: Confirm 100% patch deployment; implement policy to prevent downgrade to vulnerable versions and monitor for any CVE-2026-11085 exploitation attempts.

Google Chrome EUVD-2026-34533

| CVE-2026-11085 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-r7jm-58jj-xfm2

Google Buffer Overflow Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:25 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory access in Google Chrome on Android before version 149.0.7827.53 allows remote attackers to corrupt GPU process memory by luring a user to a crafted HTML page that triggers an integer overflow. The flaw carries a CVSS 8.8 (high) rating with high confidentiality, integrity, and availability impact, but EPSS is only 0.03% and no public exploit identified at time of analysis, suggesting low near-term mass-exploitation likelihood despite the severity of the underlying bug class.

Technical ContextAI

The vulnerability resides in Chrome's GPU component on Android, which handles graphics command buffers, texture allocation, and rasterization on behalf of the renderer. The root cause is CWE-472 (External Control of Assumed-Immutable Web Parameter) compounded by an integer overflow during size or offset arithmetic in the GPU subsystem; when the overflowed value is subsequently used as a length or index, it leads to out-of-bounds reads or writes in adjacent GPU process memory. Because the GPU process is a separate, sandboxed process in Chromium's multi-process architecture, successful corruption typically yields code execution within the GPU sandbox rather than full system compromise on its own, though it is frequently chained with a sandbox escape. The CPE coverage focuses on Chrome on Android prior to 149.0.7827.53, as confirmed by the ENISA EUVD record (EUVD-2026-34533).

RemediationAI

Patch available per vendor advisory: upgrade Google Chrome on Android to 149.0.7827.53 or later via the Google Play Store, as referenced in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked at https://issues.chromium.org/issues/500132379. For managed Android fleets, push the updated Chrome APK via MDM (Intune, Workspace ONE, Jamf) and verify the installed version. Where patching is delayed, compensating controls include disabling GPU acceleration via the chrome://flags 'Override software rendering list' or enterprise policy 'HardwareAccelerationModeEnabled=false' to force software rasterization - note this materially degrades scrolling, video, and WebGL performance - or restricting browsing on affected devices to a known-good allowlist via MDM-managed proxy. Users of Chromium-based mobile browsers should monitor their respective vendors for downstream releases incorporating the upstream fix.