What is the CVSS score of EUVD-2026-40487?

EUVD-2026-40487 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40487?

Google Chrome desktop versions prior to 150.0.7871.47 contain a high-severity sandbox escape vulnerability (CVE-2026-13801, CVSS 8.3) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate EUVD-2026-40487?

Within 24 hours: Alert all users and IT teams of this high-severity Chrome vulnerability and the mandatory vendor-released patch (Chrome 150.0.7871.47 or later). Within 7 days: Deploy the patched version across all desktop systems via your standard software distribution mechanism, prioritizing high-risk users such as developers and security researchers. Within 30 days: Complete rollout to all Chrome installations, verify compliance through endpoint inventory tools, and document the patch campaign for audit and compliance records.

Google Chrome EUVD-2026-40487

| CVE-2026-13801 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-30 chrome-cve-admin@google.com

GHSA-38p8-p9vc-4qrr

Buffer Overflow Google Red Hat

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered crafted page with UI:R and high complexity; S:C and C/I/A:H reflect a total sandbox escape; PR:N retained per NVD though a prior renderer compromise is practically required.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:03 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.3

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Chromecast component allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Affects Chrome desktop versions prior to 150.0.7871.47, rated High by Chromium with a CVSS of 8.3. There is no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and CISA SSVC records exploitation as none.

Technical ContextAI

The flaw lives in Chrome's Chromecast media-casting code path, which handles device discovery and streaming to Cast receivers. The root cause is an integer overflow: an arithmetic operation on attacker-influenced sizes or offsets wraps past its type bounds, corrupting a subsequent length/index calculation and enabling memory corruption used to escape the renderer sandbox. The CPE identifies the affected product as cpe:2.3:a:google:chrome (all versions below the fixed build). Note a taxonomy discrepancy: the description and 'Buffer Overflow'/integer-overflow signal point to a memory-safety issue, while the assigned CWE-472 (External Control of Assumed-Immutable Web Parameter) does not describe an integer overflow - the description should be treated as authoritative and the CWE mapping as likely imprecise.

RemediationAI

Vendor-released patch: 150.0.7871.47 - upgrade Chrome to 150.0.7871.47 or later on all desktop platforms and restart the browser to apply, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Because Chrome auto-updates, confirm the update actually installed via chrome://settings/help and enforce a browser restart, since staged updates do not take effect until relaunch. For managed fleets, push the minimum-version policy through your update-management channel and verify downstream rebuilds (e.g., SUSE-packaged Chromium) have picked up the fix. As an interim compensating control on unpatched endpoints, restrict or disable media-casting (Cast to device) functionality to shrink exposure of the vulnerable Chromecast code path - trade-off is loss of screen/tab casting for users; this only reduces, not eliminates, risk and is no substitute for the update. Standard renderer-hardening (site isolation, keeping sandbox enabled) raises the bar for the prerequisite renderer compromise.