What is the CVSS score of EUVD-2026-36350?

EUVD-2026-36350 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-36350?

Google Chrome on Android prior to version 149.0.7827.115 contains a sandbox escape vulnerability (CVSS 8.3) that allows attackers to escalate from an already-compromised renderer process to achieve…. A patch is available.

How to fix or mitigate EUVD-2026-36350?

Within 24 hours: Deploy Chrome version 149.0.7827.115 or later to all managed Android devices as mandatory security update. Within 7 days: Verify deployment compliance targeting 95%+ adoption and audit renderer process attack surface in your environment. Within 30 days: Conduct threat hunting for indicators of renderer compromise in logs and implement endpoint detection signatures for sandbox escape exploitation attempts.

Google Chrome EUVD-2026-36350

| CVE-2026-12030 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-11 Chrome

GHSA-jxq2-jp82-9mj4

Buffer Overflow Google Heap Overflow Red Hat Suse

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via HTML (AV:N), high complexity due to required renderer-compromise chain (AC:H), no auth (PR:N), user must visit page (UI:R), sandbox escape changes scope (S:C), full GPU-process impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 02:26 vuln.today

CVSS changed

Jun 12, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.3

DescriptionCVE.org

Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox through a heap-based out-of-bounds write in the GPU process triggered by a crafted HTML page. Chromium rates the severity High and a vendor patch is available, but no public exploit has been identified at time of analysis. The CVSS 8.3 score reflects the chained nature of the attack (compromised renderer required) combined with full impact across confidentiality, integrity, and availability.

Technical ContextAI

The flaw is a CWE-122 heap-based buffer overflow in the GPU component of Chromium on Android. Chrome's multi-process architecture isolates renderers from privileged processes via a sandbox; the GPU process accepts IPC commands from renderers and handles graphics buffers, making it a frequent target for sandbox-escape primitives. An out-of-bounds write in this trusted boundary lets a compromised renderer corrupt memory inside the higher-privileged GPU process, which on Android runs with broader access to device resources than the sandboxed renderer. The CPE cpe:2.3:a:google:chrome confirms the affected product, and the Android-only scoping in the description means desktop builds are not in scope for this specific defect.

RemediationAI

Vendor-released patch: Chrome for Android 149.0.7827.115 - upgrade Chrome on all Android devices to this version or later via Google Play, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html. There is no documented configuration workaround because the defect lives in the GPU process code path; as a temporary compensating control on managed Android fleets, restrict browsing to trusted sites via enterprise policy or use an alternative browser engine until the update is deployed, accepting the usability trade-off of lost compatibility. Because exploitation requires a prior renderer compromise, keeping Chrome fully up to date with all renderer-side fixes is itself a strong indirect mitigation, since the attacker must first land an RCE in a still-unpatched renderer bug.