What is the CVSS score of EUVD-2026-37527?

EUVD-2026-37527 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by EUVD-2026-37527?

Google Chrome for Android contains a critical remote code execution vulnerability (CVE-2026-12442) affecting versions prior to 149.0.7827.155.. A patch is available.

How to fix or mitigate EUVD-2026-37527?

Within 24 hours, identify all Android devices with Chrome versions before 149.0.7827.155 and communicate urgent update requirements to device owners; if your organization uses Mobile Device Management, push the update automatically. Within 7 days, verify that 100% of Android Chrome instances are running version 149.0.7827.155 or later through your inventory or MDM console. Within 30 days, conduct a full audit of patch deployment rates and establish automated update policies for Chrome on all Android endpoints to prevent future delays.

Google Chrome EUVD-2026-37527

| CVE-2026-12442 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Denial Of Service RCE Use After Free Google Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted-page delivery with no privileges but required user navigation (UI:R); a UAF yielding code execution gives total confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:31 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

Articles & Coverage 3

News 4 New Android Vulnerabilities - 4 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Remote code execution in Google Chrome on Android before 149.0.7827.155 stems from a use-after-free in the Passwords component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser process. Chromium rates the flaw Critical, though the assigned CVSS is 8.8; there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low at 0.39% (30th percentile), consistent with a patched, not-yet-exploited memory bug.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) in Chrome's Passwords subsystem - the browser feature responsible for storing, autofilling, and managing saved credentials. A use-after-free occurs when the program continues to reference heap memory after it has been freed; an attacker who controls subsequent heap allocations can groom that freed region and hijack the dangling pointer, typically leading to controlled memory corruption and, in Chrome's renderer/browser context, arbitrary code execution. The CPE (cpe:2.3:a:google:chrome) identifies Google Chrome as the affected product, while the description narrows real impact to the Android build. Chromium's Passwords code is shared across platforms, so the underlying defect may exist broadly even though the reported exploitable surface and fix are framed for Android.

RemediationAI

Vendor-released patch: 149.0.7827.155 - update Google Chrome on Android to 149.0.7827.155 or later via the Google Play Store; on managed fleets, push the update through MDM/enterprise policy and confirm the client version. Verify the fix and channel details against the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html and the Chromium issue https://issues.chromium.org/issues/521950423. Because exploitation requires the user to open attacker-controlled web content, effective interim compensating controls are: restricting browsing to trusted sites via enterprise policy or web-filtering/proxy blocklists to cut off delivery of crafted HTML pages (trade-off: may break legitimate sites and adds proxy overhead), and enabling Chrome's site-isolation and auto-update enforcement so devices cannot linger on vulnerable builds (trade-off: minimal, but requires MDM control). Red Hat and SUSE users should also watch their respective distribution advisories for any rebuilt packages.