What is the CVSS score of EUVD-2026-37546?

EUVD-2026-37546 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-37546?

Yes, a patch is available for EUVD-2026-37546. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-37546

| CVE-2026-12461 MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-17 Chrome

Microsoft Buffer Overflow Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page (AV:N, PR:N), passive user click needed (UI:R), memory read only so I:N and A:N, high confidentiality loss from process memory leak (C:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:37 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

MEDIUM 6.5

DescriptionCVE.org

Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read in Chrome's WebRTC subsystem on Windows exposes process memory to remote attackers who can lure victims to a crafted HTML page. Affected versions are all Chrome releases prior to 149.0.7827.155 on Windows; the flaw is classified CWE-125 and carries a CVSS score of 6.5 (High). No public exploit or active exploitation has been identified at time of analysis, and SSVC signals low urgency, but the combination of a zero-interaction network delivery path and high-confidentiality impact makes patching a clear near-term priority.

Technical ContextAI

WebRTC (Web Real-Time Communications) is a browser-native framework embedded in Chromium that handles real-time audio, video, and data channels directly in the renderer process. CWE-125 (Out-of-Bounds Read) occurs when WebRTC reads beyond the allocated buffer boundary while processing attacker-supplied content from a crafted HTML page, allowing heap or stack memory adjacent to the buffer to be surfaced to the attacker. The flaw is Windows-specific per the description, suggesting a platform-dependent code path or memory layout in the WebRTC implementation. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions below 149.0.7827.155 on Windows.

RemediationAI

Upgrade Google Chrome for Windows to version 149.0.7827.155 or later, which is the vendor-released patch confirmed by the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Chrome's auto-update mechanism will deliver this version automatically in most managed and consumer environments; administrators should verify deployment via fleet management tooling. Where immediate upgrade is not possible, a compensating control is to block or restrict access to WebRTC at the network or browser-policy level (e.g., via Chrome enterprise policy WebRtcIPHandlingPolicy), though this disables legitimate WebRTC functionality such as video conferencing. Restricting users from visiting untrusted external websites reduces exposure but does not eliminate risk from compromised trusted sites.