What is the CVSS score of EUVD-2026-40469?

EUVD-2026-40469 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40469?

Google Chrome contains a use-after-free vulnerability (CVE-2026-13783) in its UI framework that could enable attackers to execute code in the browser when users interact with specially crafted web…. A patch is available.

How to fix or mitigate EUVD-2026-40469?

24 hours: Issue urgent communication to all users and administrators of Chrome deployments recommending immediate updates; begin staging of version 150.0.7871.47 in test environments. 7 days: Deploy Chrome 150.0.7871.47 via group policy, mobile device management, or equivalent to all managed devices; monitor update status. 30 days: Verify deployment compliance and assess for any infection indicators correlated with update lag periods.

Google Chrome EUVD-2026-40469

| CVE-2026-13783 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-cm87-4c5v-7p9p

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N, PR:N) but requires a user gesture (UI:R); memory-corruption code execution in the browser process gives high C/I/A with scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 01, 2026 - 18:13 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 01, 2026 - 18:12 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 01, 2026 - 18:07 vuln.today

cvss_changed

Severity Changed

Jul 01, 2026 - 18:07 NVD

CRITICAL HIGH

CVSS changed

Jul 01, 2026 - 18:07 NVD

9.8 (CRITICAL) 8.8 (HIGH)

Analysis Generated

Jul 01, 2026 - 16:55 vuln.today

CVSS changed

Jul 01, 2026 - 16:52 NVD

9.8 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 nvd

CRITICAL 9.8

DescriptionNVD

Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Use-after-free in Google Chrome's Views UI framework, fixed in 150.0.7871.47, lets a remote attacker who lures a victim into performing specific UI gestures on a crafted HTML page trigger heap corruption and potentially achieve code execution in the browser process. Chromium rates the flaw Critical, though the CVSS is 8.8 due to required user interaction; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.22%.

Technical ContextAI

The bug lives in Views, Chromium's C++ UI toolkit that renders and manages the browser's on-screen widgets, menus, and controls (the desktop chrome around web content). The root cause is CWE-416 (Use After Free): an object in the Views subsystem is freed while a dangling pointer to it remains reachable, and a subsequent access - reached through a particular sequence of user-driven UI interactions combined with attacker-controlled page content - reuses that stale memory. Exploiting a UAF typically involves grooming the heap so the freed slot is reoccupied by attacker-influenced data, converting the dangling reference into control over program state. The affected CPE is cpe:2.3:a:google:chrome, i.e. the Chrome desktop application on all platforms served by the Stable channel.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); most installations auto-update, but administrators should force the update and have users fully restart the browser to load the patched binary, since Chrome does not apply the fix until relaunch. In managed fleets, push the update through your enterprise management channel (Chrome Browser Cloud Management, group policy, MDM, or package repos) and verify the reported version. Until the update is deployed, reduce exposure by cautioning users against interacting with untrusted pages and unexpected UI prompts, since exploitation depends on user-performed gestures; disabling or limiting untrusted web content is the only real compensating control, with the side effect of reduced usability. There is no configuration flag that specifically neutralizes this Views bug, so patching is the definitive remediation.