What is the CVSS score of EUVD-2026-36335?

EUVD-2026-36335 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-36335?

A high-severity sandbox escape vulnerability in Google Chrome's Cast component (CVE-2026-12014) allows attackers on the same local network segment to gain process-level control through memory…. A patch is available.

How to fix or mitigate EUVD-2026-36335?

Within 24 hours, inventory Chrome deployments and assess exposure to local network segments where untrusted devices might connect (BYOD networks, shared office Wi-Fi, guest networks). Within 7 days, deploy Chrome version 149.0.7827.115 or later to all affected endpoints via your standard patch management process. Within 30 days, verify patch deployment across 100% of Chrome instances, validate Cast component functionality if business-critical, and review network segmentation controls to restrict untrusted device access to network segments containing vulnerable systems.

Google Chrome EUVD-2026-36335

| CVE-2026-12014 HIGH

Use After Free (CWE-416)

2026-06-11 Chrome

GHSA-p379-73vv-4h7j

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Adjacent-network Cast traffic (AV:A), unreliable UAF weaponization (AC:H), no auth or interaction (PR:N/UI:N), and a sandbox-crossing escape with total impact (S:C, C/I/A:H).

3.1 AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:08 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Cast component (versions prior to 149.0.7827.115) lets an attacker positioned on the same local network segment corrupt memory via crafted network traffic and potentially break out of the renderer sandbox. Rated High by Chromium with a CVSS 8.3 (scope-changed, total impact), it is patched in the June 2026 Stable channel. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but a successful escape yields total control over the affected process.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Cast subsystem, the component that discovers and streams to Google Cast/Chromecast receivers over the local network. Cast relies on protocols such as mDNS/DIAL for device discovery and session negotiation, so it parses attacker-influenceable network data even without explicit user interaction. A use-after-free arises when a heap object is freed while a dangling pointer still references it; subsequent access can be steered by an attacker to corrupt memory and hijack control flow. The affected product per CPE is cpe:2.3:a:google:chrome (all versions below the fix), and because Cast processing can cross the renderer sandbox boundary, the CVSS scope is marked Changed (S:C).

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.115 or later on all desktop platforms, per Google's Stable Channel Update advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html); Chrome's built-in updater will apply this on relaunch, so ensure users restart the browser. As an interim compensating control until the update is deployed, restrict exposure to the local-network attack vector: disable the Cast/media-router feature (via enterprise policy or by not using Cast) so the vulnerable discovery/streaming code path is not exercised, and segment or filter untrusted devices on the LAN (block mDNS/DIAL traffic from unmanaged hosts) - the trade-off is loss of screen-casting to Chromecast/smart-display devices. Because the attacker must be on the same local segment, isolating corporate endpoints from guest/IoT VLANs meaningfully reduces reachability.