What is the CVSS score of EUVD-2026-40465?

EUVD-2026-40465 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40465?

Google Chrome and ChromeOS versions prior to 150.0.7871.47 contain a remote code execution vulnerability in the Chrome Remote Desktop component that enables attackers to execute arbitrary code…. A patch is available.

How to fix or mitigate EUVD-2026-40465?

Within 24 hours: Inventory all Chrome and ChromeOS systems running versions prior to 150.0.7871.47; alert teams responsible for Chrome/ChromeOS fleet management. Within 7 days: Deploy Chrome/ChromeOS version 150.0.7871.47 or later to all affected systems, prioritizing production infrastructure, customer-facing devices, and administrative endpoints. Within 30 days: Complete patching verification across the entire Chrome and ChromeOS environment and confirm zero systems remain on vulnerable versions prior to 150.0.7871.47.

Google Chrome EUVD-2026-40465

| CVE-2026-13779 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-8f7h-7jh8-32vq

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote unauthenticated network traffic (AV:N/PR:N/UI:N) but a use-after-free race gives AC:H; total system compromise yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

10.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:35 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.1 (None) 8.1 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.1

DescriptionCVE.org

Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on ChromeOS (versions prior to 150.0.7871.47) stems from a use-after-free in the Chromoting (Chrome Remote Desktop) component, letting a remote attacker corrupt memory and execute arbitrary code through malicious network traffic. Google rates the Chromium severity as Critical, and CVSS scores it 8.1 with a high attack complexity. As of this analysis there is no public exploit identified and it is not listed in CISA KEV; EPSS is low at 0.24% (15th percentile), and SSVC records exploitation status as none.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chromoting, the code path underpinning Chrome Remote Desktop on ChromeOS. Use-after-free bugs arise when memory is freed but a dangling pointer is later dereferenced; in a networked remoting stack this typically involves object lifetime races between message parsing/session handling and connection teardown, allowing an attacker who controls network traffic to reclaim the freed allocation with attacker-influenced data and hijack control flow. The single affected-CPE entry (cpe:2.3:a:google:chrome) reflects Chromium's monolithic versioning even though the description scopes impact to the ChromeOS platform, so the exploitable surface is the Chromoting subsystem rather than the general rendering engine.

RemediationAI

Vendor-released patch: 150.0.7871.47 - update Chrome/ChromeOS to 150.0.7871.47 or later per the Google Stable channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); on managed ChromeOS fleets, confirm auto-update is enabled and force a device restart so the new version applies. As a compensating control until devices update, restrict or disable Chrome Remote Desktop / Chromoting via enterprise policy (for example the RemoteAccessHostFirewallTraversal and related remote-access policies) to remove the vulnerable code path from exposure, accepting the trade-off that legitimate remote-support sessions will break; network-side, limit inbound remoting/session traffic to trusted peers to reduce the attacker's ability to deliver malicious traffic. Because AC:H makes reliable exploitation hard, timely patching is the highest-value action and should not be delayed for the workarounds.