What is the CVSS score of EUVD-2026-40511?

EUVD-2026-40511 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40511?

Google Chrome versions prior to 150.0.7871.47 contain a critical memory corruption vulnerability in the Dawn WebGPU implementation that could enable remote code execution when employees visit…. A patch is available.

How to fix or mitigate EUVD-2026-40511?

Within 24 hours: Initiate Chrome update to version 150.0.7871.47 and communicate urgency to all users; disable or restrict WebGPU functionality on managed systems if immediate updates cannot be deployed. Within 7 days: Deploy version 150.0.7871.47 across 100% of Chrome installations via your device management platform (MDM/Intune/JAMF/Google Admin) and verify completion rates daily. Within 30 days: Confirm zero instances of pre-150.0.7871.47 remain in production, conduct forensic analysis of network traffic logs for WebGPU-based exploitation attempts during the remediation period, and document completion for compliance records.

Google Chrome EUVD-2026-40511

| CVE-2026-13825 HIGH

Use of Uninitialized Variable (CWE-457)

2026-06-30 chrome-cve-admin@google.com

GHSA-c95f-v6rh-r354

Information Disclosure Google Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no auth (PR:N) but requires the victim to open it (UI:R); memory corruption in the renderer yields high C/I/A with no sandbox scope change (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:00 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Dawn WebGPU implementation lets a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and code execution in all versions prior to 150.0.7871.47. The flaw stems from use of uninitialized memory (CWE-457) and carries a High Chromium severity with a CVSS 8.8; no public exploit has been identified and EPSS is low (0.23%), and SSVC currently rates exploitation as none. A vendor patch is available in the June 2026 Stable channel update.

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU standard, providing web pages with low-level, hardware-accelerated access to the GPU for compute and rendering. Because WebGPU exposes a large native attack surface reachable directly from untrusted JavaScript/HTML in the renderer, memory-safety bugs in Dawn are high value. The root cause here is CWE-457 (Use of Uninitialized Variable): a memory region or object field is read before it is assigned a defined value, allowing an attacker to influence the uninitialized contents and steer subsequent heap operations, producing heap corruption. The affected component is identified only as Google Chrome (cpe:2.3:a:google:chrome), which bundles Dawn across desktop platforms.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html, then relaunch the browser to apply the fix (Chrome updates are staged but require a restart to take effect). In managed environments, push the update through your enterprise update policy rather than relying on user-initiated restarts. As an interim compensating control before patching, restrict WebGPU exposure by disabling the feature (chrome://flags or the enterprise policy governing unsafe/experimental WebGPU/Dawn) or by blocking untrusted browsing, accepting that disabling WebGPU breaks GPU-accelerated web apps and some canvas/compute workloads. Also ensure Chromium-based browsers built on the same engine are updated once their vendors ship the corresponding fix.