What is the CVSS score of EUVD-2026-40518?

EUVD-2026-40518 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40518?

Google Chrome versions prior to 150.0.7871.47 contain a sandbox escape vulnerability (CVSS 8.3) that enables privilege escalation when attackers compromise the renderer process, potentially extending…. A patch is available.

How to fix or mitigate EUVD-2026-40518?

Within 24 hours: Inventory Chrome and Chromium deployments, prioritizing headless instances used in automation, CI/CD, and testing. Within 7 days: Deploy Chrome version 150.0.7871.47 or later across all affected systems via standard patch management. Within 30 days: Verify 100% patch compliance enterprise-wide and configure alerting for unusual renderer process behavior.

Google Chrome EUVD-2026-40518

| CVE-2026-13832 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-pwc7-4hq7-rg87

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Delivered over the network via a crafted page (AV:N, UI:R); race-dependent use-after-free gives AC:H; sandbox escape crosses trust boundaries so S:C with total C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:34 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

8.3 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.3

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Headless in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Headless component (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page. Rated High by Chromium and CVSS 8.3, it is a CWE-416 use-after-free with no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and CISA SSVC records no known exploitation.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Chrome's Headless mode, the runtime that drives Chromium without a visible UI and is heavily used for automation, rendering, PDF generation, CI/CD, and scraping. Use-after-free occurs when memory is freed while a dangling pointer to it is still reachable; an attacker who controls heap layout can reallocate the freed region with attacker-chosen data and coerce the browser into using it, yielding memory corruption that can be steered toward arbitrary code execution. Because the bug sits at the boundary that the renderer sandbox is designed to contain, exploiting it lets attacker-controlled renderer code cross the trust boundary into the higher-privileged browser process, which is why CVSS marks Scope as Changed (S:C).

RemediationAI

Vendor-released patch: 150.0.7871.47 - update Google Chrome to 150.0.7871.47 or later on all platforms via the Stable channel and relaunch the browser to apply it, per Google's advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). In managed environments, force the update through group policy/MDM and confirm the running version, since a pending relaunch leaves the vulnerable binary active. No standalone workaround fully addresses a memory-corruption sandbox escape; as compensating controls until patching completes, restrict or disable use of Chrome Headless in exposed automation/CI pipelines that render untrusted HTML (accepting reduced automation capability), avoid pointing headless jobs at untrusted URLs, and keep site isolation enabled - noting these reduce but do not eliminate exposure. Downstream Chromium-based browsers (Edge, Brave, etc.) should be updated once their respective vendors ship the merged fix.