What is the CVSS score of EUVD-2026-40530?

EUVD-2026-40530 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-40530?

A privilege escalation vulnerability in Google Chrome for Windows (versions before 150.0.7871.47) could allow an attacker with local system access to gain administrative privileges; however, the low…. A patch is available.

How to fix or mitigate EUVD-2026-40530?

Within 24 hours: notify users and IT teams of the vulnerability and patch availability. Within 7 days: deploy Chrome 150.0.7871.47 or later to all Windows systems via your endpoint management platform. Within 30 days: verify 100% compliance through vulnerability scans and reporting.

Google Chrome EUVD-2026-40530

| CVE-2026-13844 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-gxhr-cwf9-9hr8

Privilege Escalation Denial Of Service Google Use After Free Memory Corruption Microsoft Red Hat Suse

7.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector via a malicious file needing user interaction (AV:L/UI:R) with no prior privileges (PR:N), yielding full OS-level compromise, hence high C/I/A.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:32 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

7.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 7.8

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

AnalysisAI

Local OS-level privilege escalation in Google Chrome on Windows (versions prior to 150.0.7871.47) arises from a use-after-free in the Chrome Updater component, letting a local attacker who can plant a malicious file on the system elevate to higher OS privileges. Google rates the Chromium severity as High and has released a fixed Stable channel build; there is no public exploit identified and it is not listed in CISA KEV. EPSS is low at 0.13% (3rd percentile), consistent with a bug that requires local access and user interaction rather than mass remote exploitation.

Technical ContextAI

The flaw is a CWE-416 use-after-free within the Chrome Updater - the auto-update service (Google Update / GoogleUpdater) that on Windows can run with elevated/SYSTEM privileges to install browser updates. A use-after-free occurs when memory is freed but a dangling pointer is subsequently dereferenced, allowing an attacker to control the reused allocation and corrupt program state. Because the Updater operates as a privileged Windows component, corrupting its execution via a malicious file yields OS-level privilege escalation rather than mere browser-sandbox compromise. The single affected CPE, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, is Windows-specific per the description.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 150.0.7871.47 or later on Windows via the Stable channel; the primary fix is to allow Chrome's auto-update to apply the patched build and relaunch the browser to complete installation, or push the update through enterprise management (Google Update policies / MSI). Verify via chrome://settings/help. See the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As a compensating control until patched, restrict local/interactive logon and file-write access on shared Windows hosts so untrusted users cannot stage the malicious file the exploit requires, and monitor for unexpected activity by the Google Updater service - trade-off is that this does not remove the flaw and tightening local access can disrupt legitimate shared-workstation use; disabling the Updater entirely would break automatic security updates and is not recommended.