What is the CVSS score of EUVD-2026-39049?

EUVD-2026-39049 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-39049?

Google Chrome on Android devices running outdated versions is vulnerable to remote code execution attacks when users visit malicious websites, creating a direct threat to employee device security and…. A patch is available.

How to fix or mitigate EUVD-2026-39049?

Within 24 hours: Notify all users with Android devices to update Chrome to version 149.0.7827.197 or later through the Google Play Store; verify update availability in your MDM if applicable. Within 7 days: Confirm through device inventory systems that at least 95% of Chrome users on Android have applied the patch; audit non-compliant devices. Within 30 days: Complete full remediation of all Android devices running Chrome, including corporate and BYOD endpoints; document compliance in your vulnerability management system.

Google Chrome EUVD-2026-39049

| CVE-2026-13037 HIGH

Use After Free (CWE-416)

2026-06-24 Chrome

GHSA-7898-6x7p-pr8g

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

7.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Victim must open crafted HTML (UI:R) and the vector is local per the description (AV:L); no privileges needed (PR:N), and renderer code execution yields high C/I/A within an unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:36 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

7.8 (HIGH)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

HIGH 7.8

DescriptionCVE.org

Use after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Arbitrary code execution within the renderer sandbox affects Google Chrome on Android before 149.0.7827.197 via a use-after-free defect in the WebView component, reachable when a victim renders a crafted HTML page. The flaw lets an attacker corrupt freed memory in the rendering process to gain code execution confined to the sandbox; CVSS is 7.8 (High) and Chromium rates it High severity. There is no public exploit identified at time of analysis, and CISA SSVC marks exploitation status as none, but a vendor patch is already available.

Technical ContextAI

The defect is a CWE-416 use-after-free in Chrome's WebView, the embeddable browser/rendering engine built on Chromium's Blink and V8 stack that Android apps and Chrome itself use to display web content. A use-after-free occurs when memory is freed but a dangling pointer is subsequently dereferenced, allowing an attacker who controls heap layout and object lifetimes (via crafted HTML/DOM manipulation) to reclaim the freed allocation with attacker-controlled data and ultimately hijack control flow. The single CPE provided (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) identifies the affected product as Google Chrome generally, while the description scopes the impact specifically to the Android WebView code path. Per the description, resulting code execution is contained inside the Chromium sandbox, meaning no sandbox escape or OS-level compromise is claimed by this CVE alone.

RemediationAI

Vendor-released patch: 149.0.7827.197 - upgrade Google Chrome (and any embedded WebView/Chrome on Android) to 149.0.7827.197 or later, which is the primary and recommended fix per Google's Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html); on Android this also means ensuring the Android System WebView and Chrome apps are updated via the Play Store. Because exploitation requires the victim to open attacker-controlled HTML, interim compensating controls until the update is deployed include restricting browsing to trusted sites and blocking untrusted/unknown links through web/email filtering (trade-off: user friction and incomplete coverage), and for managed fleets enforcing automatic Chrome/WebView updates via enterprise policy to remove the version-lag window (trade-off: requires MDM/policy management). No reliable feature-disable workaround exists for a memory-corruption bug in the renderer, so patching is the only durable remediation; refer to the Chromium issue https://issues.chromium.org/issues/523721871 for technical tracking.