What is the CVSS score of EUVD-2026-39043?

EUVD-2026-39043 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-39043?

Google Chrome desktop installations prior to version 149.0.7827.197 contain a heap corruption vulnerability in the WebAuthn component that could enable code execution through malicious browser…. A patch is available.

How to fix or mitigate EUVD-2026-39043?

Within 24 hours: Alert IT and Chrome users of the vulnerability and the available patch. Within 7 days: Deploy Chrome 149.0.7827.197 or later across all desktop endpoints using your standard patch management process. Within 30 days: Verify 100% deployment completion and strengthen browser extension policies to prevent unauthorized installation of third-party extensions.

Google Chrome EUVD-2026-39043

| CVE-2026-13029 HIGH

Use After Free (CWE-416)

2026-06-24 Chrome

GHSA-p9w8-5hg8-pp9p

Denial Of Service Google Use After Free Memory Corruption Red Hat

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Remotely delivered via extension (AV:N, PR:N) but requires a user-installed malicious extension (UI:R) and unreliable heap grooming (AC:H), yielding total in-process impact (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:34 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Web Authentication (WebAuthn) component affects all desktop builds prior to 149.0.7827.197, where a use-after-free (CWE-416) can be triggered by a malicious browser extension. An attacker who first convinces a victim to install a crafted extension can reach the freed object and potentially achieve code execution. Rated High by Chromium with a CVSS 7.5; there is no public exploit identified at time of analysis and CISA SSVC marks exploitation as none.

Technical ContextAI

The flaw lives in Chrome's Web Authentication subsystem, the browser-side implementation of the WebAuthn/FIDO2 API that brokers communication between web origins and authenticators (security keys, platform authenticators) for passwordless and second-factor login. The root cause is a use-after-free (CWE-416): an object backing a WebAuthn operation is freed while a reference to it is still held, so a subsequent access dereferences dangling memory and corrupts the heap. The malicious-extension delivery path indicates the bug is reachable through the privileged extension API surface that can drive WebAuthn flows, rather than from arbitrary untrusted web content. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, and the fix landed in the Chrome stable channel at 149.0.7827.197.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.197 or later via the stable desktop channel; the fix is available per the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html (Chromium issue https://issues.chromium.org/issues/521495992). Trigger the update from chrome://settings/help and restart the browser to apply it, and ensure Chromium-based browsers are updated to a build that incorporates the same upstream fix. Because exploitation requires installing a malicious extension, the most effective compensating control until patching completes is enterprise extension management: enforce an ExtensionInstallAllowlist/ExtensionInstallBlocklist (or force-install only vetted extensions) and disable user-installed extensions via Chrome policy - the trade-off is reduced user flexibility and potential helpdesk friction for legitimate add-ons. Restricting installs to the Chrome Web Store and reviewing requested extension permissions further narrows the delivery path without fully eliminating it.