What is the CVSS score of EUVD-2026-40509?

EUVD-2026-40509 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40509?

Google Chrome versions before 150.0.7871.47 contain a sandbox escape vulnerability (CVE-2026-13823) that allows an attacker who has compromised the browser renderer process to break out of sandbox…. A patch is available.

How to fix or mitigate EUVD-2026-40509?

Within 24 hours, inventory all systems running Chrome versions before 150.0.7871.47 and declare a priority patch deployment window. Within 7 days, deploy Chrome 150.0.7871.47 or later organization-wide via Group Policy, MDM, or cloud-managed Chrome policies, with notification to all users explaining the security criticality. Within 30 days, audit endpoint compliance to confirm 100% patch deployment, document patch timestamps in your vulnerability management system, and update your Chrome baseline configuration to enforce version 150.0.7871.47 or later as the minimum allowed release.

Google Chrome EUVD-2026-40509

| CVE-2026-13823 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-cv62-6526-38hx

Denial Of Service Google Use After Free Memory Corruption Red Hat

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Reachable from a page but requires precise heap grooming (AC:H) and page load (UI:R); sandbox escape crosses a trust boundary (S:C) with total renderer-to-browser impact (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:01 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.3

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Glic component before version 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Rated High by Chromium with a CVSS of 8.3 and a scope-changing vector; there is no public exploit identified at time of analysis, and EPSS is low at 0.21%. SSVC shows no known exploitation and Google has released a patched Stable channel build.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Glic, a component of the Chromium/Google Chrome browser. Use-after-free occurs when memory is freed but a dangling pointer is subsequently dereferenced, allowing an attacker who controls heap layout to reclaim the freed allocation with attacker-controlled data and hijack subsequent object usage. In Chrome's multi-process architecture, renderer processes are sandboxed and untrusted; a bug like this in a higher-privileged browser-side component (Glic) is significant because it can be reached from a compromised renderer to cross the sandbox boundary - reflected in the CVSS Scope:Changed metric. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome application across platforms prior to the fixed build.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel; restart the browser to apply the update (per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Enterprises should push the update through managed deployment and confirm auto-update is enabled, and SUSE/Chromium-derived distributions should apply the corresponding vendor package once released. If patching must be delayed, compensating controls include enabling Chrome's site isolation (default) and, for high-risk users, running Chrome with the renderer/sandbox hardening intact and restricting untrusted browsing; because exploitation requires a prior renderer compromise, keeping the browser fully updated to close the initial renderer bug is the most effective mitigation. There is no feature-level workaround specific to Glic, so upgrading is the definitive fix.