What is the CVSS score of EUVD-2026-37534?

EUVD-2026-37534 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-37534?

Google Chrome for Windows contains a local privilege escalation vulnerability in the Remote Desktop component that allows attackers to gain administrative system access if users open malicious files.. A patch is available.

How to fix or mitigate EUVD-2026-37534?

Within 24 hours: Inventory all Chrome installations on Windows devices and notify users of the upcoming security update to address privilege escalation risks. Within 7 days: Deploy Chrome version 149.0.7827.155 or later across all affected Windows systems through your standard patch management process. Within 30 days: Verify patch deployment completion through automated inventory scanning and confirm all systems report Chrome version 149.0.7827.155 or later.

Google Chrome EUVD-2026-37534

| CVE-2026-12449 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Denial Of Service Use After Free Google Microsoft Memory Corruption Privilege Escalation

7.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector requiring a user to open a malicious file (AV:L/UI:R) with no prior privileges (PR:N); memory-corruption privilege escalation yields high C/I/A on the same system (S:U).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:04 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 7.8

DescriptionCVE.org

Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

Articles & Coverage 3

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 4 New Windows Vulnerabilities - 1 Critical, 3 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Local privilege escalation in Google Chrome for Windows before 149.0.7827.155 stems from a use-after-free in the Chromoting (Chrome Remote Desktop) component, letting a local attacker who convinces a user to open a malicious file execute code at OS-level privilege. Chromium rates the severity High and a vendor patch is available; currently there is no public exploit identified at time of analysis, and EPSS is low at 0.17% (6th percentile). SSVC lists exploitation as none but technical impact as total.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chromoting, the code path behind Chrome Remote Desktop that brokers screen-sharing and remote-input sessions on the host. A use-after-free occurs when memory is referenced after it has been released; an attacker who controls allocation and reuse of that freed object can corrupt the heap and steer execution. Because Chromoting components on Windows interact with host-level session and desktop resources, successful corruption can be leveraged to escalate from the browser context to OS-level privileges. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the Chrome application as the affected product, with the defect specific to the Windows build.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.155 - upgrade all Windows Chrome installations to 149.0.7827.155 or later, per the Chrome Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html; Chrome's built-in updater will apply this automatically once relaunched, so ensuring users restart the browser is the fastest remediation. Where immediate patching is not possible, reduce exposure by disabling or uninstalling the Chrome Remote Desktop / Chromoting host component on systems that do not require remote access, since the flaw lives in that component; this removes remote-desktop functionality for those hosts as a trade-off. As a supporting control, restrict users' ability to open untrusted files that could trigger the code path and enforce enterprise auto-update policies via Chrome ADMX so builds cannot lag behind the fixed version.