What is the CVSS score of EUVD-2026-37547?

EUVD-2026-37547 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by EUVD-2026-37547?

Google Chrome's Media component contains a vulnerability (CVE-2026-12462) that could enable attackers to escalate compromised browser sessions into deeper system access, particularly if exploited in…. A patch is available.

How to fix or mitigate EUVD-2026-37547?

Within 24 hours, notify Chrome administrators and end-user IT teams of the security update, verify current Chrome version distributions across your environment, and prepare a staged deployment plan through your browser management system. Within 7 days, deploy Chrome version 149.0.7827.155 or later to all systems, prioritizing those handling sensitive data or critical operations. Within 30 days, verify patch compliance through your MDM or browser telemetry, document remediation for audit records, and confirm version 149.0.7827.155 has reached at least 95% of your fleet.

Google Chrome EUVD-2026-37547

| CVE-2026-12462 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Denial Of Service RCE Use After Free Google Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Description requires a pre-compromised renderer (PR:L) plus victim loading crafted media (UI:R) and reliable UAF grooming (AC:H); impact is full but confined to the sandboxed renderer (S:U).

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:37 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Arbitrary code execution in Google Chrome's Media component (versions prior to 149.0.7827.155) lets an attacker who has already compromised the renderer process run code within the sandbox by serving a crafted HTML page. Rated High by Chromium and CVSS 7.5, the flaw is a use-after-free (CWE-416); there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.37%, 28th percentile), consistent with the SSVC 'Exploitation: none' status. In practice it functions as a second-stage bug useful for extending a renderer foothold rather than an initial-access vulnerability.

Technical ContextAI

The vulnerability sits in Chrome's Media subsystem, which handles decoding and playback of audio/video content delivered through HTML (e.g., <video>/<audio> elements and associated media pipelines). CWE-416 (Use After Free) means a memory object in the media pipeline is freed but a dangling pointer is subsequently dereferenced, allowing an attacker who controls heap layout to reclaim the freed allocation and steer execution. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e., the Chrome desktop browser; because Chromium is the shared engine, downstream Chromium-based browsers and Red Hat/SUSE Chromium packages (reflected in the tags) inherit the same defect until they rebase to a fixed engine.

RemediationAI

Vendor-released patch: 149.0.7827.155 - upgrade Google Chrome to 149.0.7827.155 or later and restart the browser to load the new binary (Chrome auto-updates but requires a relaunch to apply), per the Chrome Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. For Chromium-based distributions, apply the corresponding Red Hat/SUSE Chromium package updates once published. Where immediate patching is not possible, reduce exposure to the initial renderer compromise this bug depends on by keeping Chrome's site isolation enabled (default) and enforcing enterprise auto-update policies so relaunches are not deferred, and restrict rendering of untrusted media/HTML content; note that broadly blocking media playback would break legitimate sites, so prioritize the patch over content-blocking workarounds.