What is the CVSS score of EUVD-2026-39045?

EUVD-2026-39045 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-39045?

Google Chrome versions prior to 149.0.7827.197 contain a critical remote code execution vulnerability in the Blink rendering engine allowing arbitrary code execution when users visit a malicious…. A patch is available.

How to fix or mitigate EUVD-2026-39045?

Within 24 hours: Issue mandatory update notification requiring Chrome 149.0.7827.197 or later and deploy endpoint policies to block legacy versions. Within 7 days: Audit deployment logs to confirm >95% patching compliance and review web gateway logs for payloads exploiting CVE-2026-13031. Within 30 days: Conduct forensic analysis of endpoints with delayed patching, prioritizing machines that accessed untrusted domains during the preceding 30 days, for signs of malware installation or privilege escalation.

Google Chrome EUVD-2026-39045

| CVE-2026-13031 HIGH

Use After Free (CWE-416)

2026-06-24 Chrome

GHSA-f88h-fjvm-fgph

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable via a crafted page needing only a page visit (UI:R) and no auth (PR:N); use-after-free yields full renderer-process compromise, but scope stays Unchanged as code runs inside the sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:33 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Blink rendering engine (versions prior to 149.0.7827.197) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV, though Chrome browser bugs of this class are historically high-value targets. Exploitation requires user interaction (loading a malicious page) but no authentication.

Technical ContextAI

Blink is Chromium's rendering engine, responsible for parsing and laying out HTML, CSS, and executing DOM operations driven by JavaScript. CWE-416 (Use After Free) means an object on the heap is freed while a dangling reference to it remains reachable; subsequent access lets an attacker reuse the freed memory with attacker-controlled data, corrupting object state and ultimately redirecting execution. The single CPE provided, cpe:2.3:a:google:chrome:*, is open-ended on version, but the EUVD constraint scopes impact to builds before 149.0.7827.197. Notably the advisory states code execution occurs 'inside a sandbox' - the Blink renderer runs in Chrome's sandboxed process, so this primitive yields renderer-process compromise rather than full host takeover unless chained with a separate sandbox-escape bug.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.197 (Stable channel) - update to this version or later via Chrome's built-in updater (chrome://settings/help) and relaunch to apply, then confirm Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) pick up the corresponding Blink fix from their own vendors. The fix is documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html (bug https://issues.chromium.org/issues/523308824). Where immediate patching is not possible, compensating controls include enforcing Chrome's site isolation and sandbox (do not launch with --no-sandbox), deploying enterprise policy to force automatic updates, and restricting browsing to trusted sites via URL allow-listing or a web proxy - the trade-off being reduced user flexibility and that allow-listing does not stop malvertising or compromised trusted sites. Disabling JavaScript would block most Blink exploitation paths but breaks the majority of modern web applications, so it is rarely viable fleet-wide.