What is the CVSS score of EUVD-2026-40521?

EUVD-2026-40521 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40521?

Google Chrome versions prior to 150.0.7871.47 contain a heap corruption vulnerability in the XML parser affecting all desktop platforms.. A patch is available.

How to fix or mitigate EUVD-2026-40521?

Within 24 hours, inventory all Chrome deployments and establish a patch rollout timeline. During days 2-7, distribute Chrome version 150.0.7871.47 or later to all affected systems via automatic updates or enterprise management tools. By day 30, verify that all endpoints have been updated to the patched version through device inventory, confirm no blocking issues have emerged, and document completion of the remediation.

Google Chrome EUVD-2026-40521

| CVE-2026-13835 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-30 chrome-cve-admin@google.com

GHSA-785q-pvw8-v82f

Buffer Overflow Google Heap Overflow Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page requires the victim to browse (UI:R) with no auth (PR:N); heap corruption enables full renderer compromise, giving high C/I/A with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:58 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's XML implementation on all desktop platforms prior to 150.0.7871.47 allows a remote attacker to potentially achieve code execution when a victim visits a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8 (network vector, user interaction required), this is a memory-safety flaw (CWE-122 heap-based buffer overflow) reported through Google's internal CVE process. There is no public exploit identified at time of analysis, and SSVC assessment shows exploitation status of none with a low EPSS of 0.21%.

Technical ContextAI

The flaw resides in Chrome's XML handling subsystem, which parses and processes XML content encountered while rendering web pages (e.g., XML documents, XSLT, or XML embedded in HTML). The root cause is classified as CWE-122 (heap-based buffer overflow), meaning attacker-influenced data causes a write beyond the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or objects. In a browser context this typically stems from an 'inappropriate implementation' - a logic error in bounds handling or object lifetime within the XML component of Blink/Chromium - and heap corruption is the classic primitive leveraged toward renderer-process compromise. The affected component ships in Chromium, so Chromium-derived browsers (Edge, Brave, Opera, SUSE-packaged builds noted in the tags) share the same code path. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the Google Chrome application as the affected product across versions below the fixed build.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms; Chrome auto-updates, but administrators should force the update and restart the browser to apply it, verifying the version via chrome://settings/help. Users of Chromium-based browsers (Edge, Brave, Opera) and Linux distribution packages (e.g., SUSE) should install their vendor's build that incorporates this fix once available. The authoritative source is the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If patching cannot be completed immediately, interim compensating controls include enabling Chrome's Enhanced Safe Browsing and, in managed environments, using enterprise policies to restrict browsing to trusted sites - with the trade-off of reduced usability; note that site isolation and the renderer sandbox already reduce (but do not eliminate) the impact of renderer heap corruption, so they are mitigations, not substitutes for the update.