What is the CVSS score of EUVD-2026-37522?

EUVD-2026-37522 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-37522?

Google Chrome's WebShare component (Windows) contains a use-after-free vulnerability (CVSS 8.3) that permits sandbox escape in systems where the browser renderer has been compromised.. A patch is available.

How to fix or mitigate EUVD-2026-37522?

Within 24 hours: inventory Chrome deployments on Windows systems and confirm automatic update status for Chrome browser. Within 7 days: deploy Chrome version 149.0.7827.155 or later across all Windows Chrome installations via your standard patch distribution mechanism (automatic updates, enterprise management, or manual user notification). Within 30 days: audit deployment logs to confirm >95% update coverage and document any systems that remain unpatched with documented business justification.

Google Chrome EUVD-2026-37522

| CVE-2026-12437 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Denial Of Service Use After Free Google Microsoft Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H for the UAF race plus mandatory prior renderer compromise, UI:R for loading a page, and S:C with C/I/A:H because a sandbox escape breaches the browser/OS boundary with full host impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:33 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Articles & Coverage 3

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 4 New Windows Vulnerabilities - 1 Critical, 3 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Sandbox escape in Google Chrome's WebShare component on Windows (versions before 149.0.7827.155) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a critical-severity use-after-free (CWE-416) rated CVSS 8.3; there is no public exploit identified at time of analysis, CISA SSVC lists exploitation status as none, and EPSS is low at 0.31%. It is a second-stage bug meant to be chained after an initial renderer compromise rather than a standalone remote takeover.

Technical ContextAI

WebShare is the Chromium implementation of the W3C Web Share API, which lets web pages invoke the operating system's native share dialog through a privileged browser process on behalf of the sandboxed renderer. The vulnerability is a use-after-free (CWE-416): a heap object is freed while a dangling reference remains, and subsequent reuse of that memory allows an attacker to corrupt state in a more privileged context. Because WebShare bridges the untrusted renderer to Windows platform sharing services, memory corruption here provides a path to execute attacker-controlled logic outside the renderer sandbox. The single supplied CPE (cpe:2.3:a:google:chrome) does not encode the Windows-specific platform or the version boundary, which come from the description and EUVD data.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.155 or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html, and relaunch the browser since staged Chrome updates only take effect after restart. In managed environments, force the update through enterprise policy (e.g. auto-update rollout / TargetVersionPrefix) rather than relying on user-initiated relaunch. Because the bug requires a prior renderer compromise, a strong compensating control while patching is keeping Chrome's Site Isolation and renderer sandbox strictly enforced; where the Web Share feature is not needed you can reduce the attack surface via enterprise policy, with the trade-off that native share functionality breaks for users. Additional advisory context is at Chromium issue https://issues.chromium.org/issues/516496659 and https://vuldb.com/vuln/371510.