What is the CVSS score of EUVD-2026-36349?

EUVD-2026-36349 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-36349?

Google Chrome for Windows contains a sandbox escape vulnerability (CVE-2026-12029) that could allow attackers to achieve complete system control after compromising a user's browser process.. A patch is available.

How to fix or mitigate EUVD-2026-36349?

Within 24 hours, assess the extent of Google Chrome deployment across your Windows infrastructure and communicate the urgent patch requirement to end users, IT staff, and security teams, emphasizing that this vulnerability requires user interaction to exploit and poses a significant system compromise risk. Within 7 days, deploy Chrome 149.0.7827.115 or later to all Windows systems through your standard update mechanism (automatic updates or managed deployment via Group Policy), prioritizing systems with the highest user interaction and external-facing roles. Within 30 days, conduct a comprehensive audit to verify all Windows endpoints are running Chrome 149.0.7827.115 or later, establish automated Chrome version tracking in your endpoint monitoring solutions, and document patch deployment for compliance records.

Google Chrome EUVD-2026-36349

| CVE-2026-12029 HIGH

Use After Free (CWE-416)

2026-06-11 Chrome

GHSA-7jv2-7jq5-c8vc

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Delivered remotely via a web page (AV:N/UI:R) but requires a pre-compromised renderer and heap grooming (AC:H); the sandbox escape crosses a trust boundary (S:C) with full impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:04 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Video in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.115 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the Video component. Rated High by Chromium and CVSS 8.3 with a scope change (S:C), it requires user interaction (visiting a malicious page) and is typically the second stage of a full RCE chain. There is no public exploit identified at time of analysis, and the low EPSS score (0.07%, 21st percentile) plus SSVC 'Exploitation: none' indicate no observed in-the-wild activity yet.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Video subsystem, part of the Chromium media pipeline that decodes and renders video content driven by HTML/JavaScript. Use-after-free occurs when a pointer to freed heap memory is reused, allowing an attacker who controls heap layout to reclaim that memory and coerce the browser into executing under attacker-influenced state. Per the CPE (cpe:2.3:a:google:chrome), all Chrome builds on Windows below 149.0.7827.115 are affected; because the bug lives in the sandboxed renderer's interaction with more-privileged browser/GPU processes, exploiting it as a sandbox escape corresponds to the CVSS scope change (S:C), where compromise crosses the renderer trust boundary into the broader browser process.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.115 or later on Windows via the Chrome stable channel; verify through chrome://settings/help and relaunch to apply, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html). For Chromium-based Edge and Linux distro packages, apply the corresponding SUSE/Red Hat/Microsoft updates once published. If patching must be delayed, reduce exposure by enforcing automatic browser updates via group policy, and as an interim hardening measure enable Chrome's 'Enhanced Security' / Site Isolation and strict Safe Browsing so that untrusted sites are less able to stage the renderer compromise that this bug depends on; note these controls reduce but do not eliminate risk and may affect performance or compatibility on some sites. Because the bug requires a prior renderer compromise, blocking untrusted/malvertising domains at the web proxy or DNS layer is a meaningful compensating control, with the trade-off of maintenance overhead and potential false positives.