What is the CVSS score of EUVD-2026-37523?

EUVD-2026-37523 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-37523?

A sandbox escape vulnerability in Google Chrome for Android (CVE-2026-12438, CVSS 8.3) could enable privilege escalation from a compromised renderer process to the browser process, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-37523?

Within 24 hours: Inventory Chrome and WebView versions across mobile devices and applications to identify exposure scope and affected user population. Within 7 days: Deploy vendor patch (Chrome 149.0.7827.155 or later) through your mobile device management solution and coordinate with development teams to update WebView-dependent applications. Within 30 days: Verify patch deployment across all managed devices and applications, review system logs for anomalous renderer-level activity, and confirm complete remediation across your mobile environment.

Google Chrome EUVD-2026-37523

| CVE-2026-12438 HIGH

Protection Mechanism Failure (CWE-693)

2026-06-17 Chrome

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R reflect the required prior renderer compromise and content-loading; S:C with C/I/A:H capture the sandbox escape into the more privileged browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:33 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.3

DescriptionCVE.org

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Articles & Coverage 3

News 4 New Android Vulnerabilities - 4 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Sandbox escape in Google Chrome for Android's WebView allows a remote attacker who has already compromised the renderer process to break out to the more privileged browser process via a crafted HTML page, in all versions prior to 149.0.7827.155. Rated Critical by Chromium and CVSS 8.3 (scope-changing) by NVD, it is a second-stage exploit primitive rather than a standalone entry point. No public exploit is identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.29% (21st percentile).

Technical ContextAI

The affected component is Android WebView, the embeddable Chromium engine that renders web content inside Chrome and countless third-party Android apps. Chrome uses a multi-process sandbox model in which untrusted web content executes in a restricted renderer process isolated from the privileged browser process. The root cause is classified as CWE-693 (Protection Mechanism Failure): an 'inappropriate implementation' weakens or bypasses the sandbox boundary that is supposed to contain a compromised renderer. The single affected CPE is cpe:2.3:a:google:chrome, but because WebView is a shared system component, the exposure extends to the Android WebView runtime and apps embedding it, not just the standalone Chrome browser.

RemediationAI

Vendor-released patch: update Google Chrome / Android System WebView to 149.0.7827.155 or later via Google Play or the Chrome Stable channel (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html); this is the primary and complete fix. Because WebView is a shared system component, ensure both the Chrome app and the 'Android System WebView' package are updated, and prompt a browser restart so the new binary loads. No standalone workaround fully substitutes for the patch since the sandbox is an internal boundary, but interim risk can be reduced by keeping Chrome's built-in Site Isolation and renderer sandbox enabled (do not launch with sandbox-disabling flags), avoiding untrusted or attacker-controlled web content in embedded WebViews, and applying pending updates for any renderer-side vulnerabilities that would be needed to reach this bug - the trade-off being that these only raise the bar rather than eliminating the flaw.