What is the CVSS score of EUVD-2026-37549?

EUVD-2026-37549 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-37549?

Google Chrome before version 149.0.7827.155 contains a sandbox escape vulnerability that allows attackers with prior renderer compromise to escalate privileges and potentially achieve system-level…. A patch is available.

How to fix or mitigate EUVD-2026-37549?

Within 24 hours, notify all Chrome users and administrators of the available update to version 149.0.7827.155 or later and enable automatic updates if not currently configured. Within 7 days, begin staged deployment of Chrome 149.0.7827.155+ across enterprise and personal devices, prioritizing systems with higher web-browsing exposure. Within 30 days, verify through browser telemetry that at least 95% of Chrome installations have been updated to the patched version.

Google Chrome EUVD-2026-37549

| CVE-2026-12464 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Memory Corruption Use After Free Google Denial Of Service

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Renderer compromise is a real prerequisite, so PR:L rather than PR:N; AC:H for the heap/timing condition, UI:R for page load, S:C and C/I/A:H for the privileged sandbox escape.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:35 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Sandbox escape in Google Chrome desktop before 149.0.7827.155 lets an attacker who has already compromised the renderer process leverage a use-after-free in the privileged Browser process to break out of the renderer sandbox via a crafted HTML page. Rated High by Chromium and CVSS 8.3, it is a second-stage exploitation primitive rather than a standalone entry point. No public exploit is identified at time of analysis and EPSS is low (0.27%), consistent with SSVC exploitation status of 'none'.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Browser process, the high-privilege broker that mediates access to the OS on behalf of sandboxed renderer processes in Chromium's multi-process architecture. A use-after-free occurs when a pointer to freed heap memory is reused, allowing an attacker who controls heap layout to overwrite the freed object and hijack a subsequent dereference. Because the Browser process runs outside the renderer sandbox, corrupting its memory is a path to sandbox escape. The affected CPE is cpe:2.3:a:google:chrome:*, covering the Chrome desktop application across platforms; Red Hat and SUSE tags indicate downstream Linux distribution rebuilds are also affected.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.155; upgrade all desktop Chrome installations to 149.0.7827.155 or later, per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Ensure Chrome auto-update is enabled and force a relaunch so the update takes effect, and apply corresponding vendor updates for Chromium-based browsers and Red Hat/SUSE packages once published. There is no product-specific configuration workaround for the underlying use-after-free; because exploitation requires a compromised renderer first, defense-in-depth compensating controls while patching include enabling the Site Isolation and strict site-per-process defaults (already on by default), deploying enterprise policies to restrict untrusted extensions and risky content, and prioritizing patching of any paired renderer-side vulnerabilities - with the trade-off that these reduce but do not eliminate the sandbox-escape risk.