What is the CVSS score of EUVD-2026-40470?

EUVD-2026-40470 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40470?

A use-after-free vulnerability in Google Chrome versions prior to 150.0.7871.47 enables remote code execution when users visit malicious web pages, with no public exploit identified at time of…. A patch is available.

How to fix or mitigate EUVD-2026-40470?

Within 24 hours: Identify and inventory all Chrome installations in the enterprise. Within 7 days: Deploy Chrome 150.0.7871.47 or later to all endpoints via patch management system; prioritize systems used for sensitive business functions. Within 30 days: Audit logs for exploitation attempts and confirm 100% remediation across the environment.

Google Chrome EUVD-2026-40470

| CVE-2026-13784 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-53xj-rc8w-cqh3

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N) with low complexity but required user gestures (UI:R), no auth (PR:N); memory corruption yields total C/I/A impact in a single component (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 21:32 vuln.today

Severity Changed

Jul 01, 2026 - 19:37 NVD

CRITICAL HIGH

CVSS changed

Jul 01, 2026 - 19:37 NVD

9.6 (CRITICAL) 8.8 (HIGH)

CVSS changed

Jul 01, 2026 - 19:22 NVD

9.6 (None) 9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 nvd

HIGH 8.8

DescriptionNVD

Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Use-after-free in Google Chrome's Views UI framework prior to 150.0.7871.47 lets a remote attacker trigger heap corruption after luring a user to a crafted HTML page and performing specific UI gestures, potentially achieving code execution in the renderer/browser process. Chromium rates the flaw Critical, though the CVSS is 8.8 due to required user interaction. No public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile); SSVC lists exploitation as none but technical impact as total.

Technical ContextAI

The bug is a CWE-416 use-after-free in Views, Chromium's cross-platform C++ UI toolkit that renders and manages the browser's widgets, menus, dialogs, and window chrome. A use-after-free occurs when memory is freed while a dangling pointer still references it; if an attacker can control reallocation of that freed region, dereferencing the stale pointer corrupts the heap and can be steered toward controlled execution. Here, specific UI gestures (e.g., interacting with menus/dialogs driven by attacker-controlled page content) desynchronize object lifetime from an outstanding reference. The affected CPE is cpe:2.3:a:google:chrome, i.e. the desktop Chrome browser across platforms served by the stable channel.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on the stable channel (Windows, macOS, Linux) via the built-in updater or by relaunching the browser, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; the issue is tracked at https://issues.chromium.org/issues/516962715. In managed fleets, force the update through enterprise policy and confirm the version to ensure the fix is applied. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites, since exploitation requires loading a crafted HTML page and performing UI gestures; users of Chromium-based browsers should apply their vendor's equivalent update once the upstream fix is merged. There is no documented feature toggle that disables Views, so patching is the only reliable remediation.