What is the CVSS score of EUVD-2026-40534?

EUVD-2026-40534 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-40534?

Google Chrome desktop contains a high-severity remote code execution vulnerability (CVSS 8.8) that can be exploited when users visit a malicious website.. A patch is available.

How to fix or mitigate EUVD-2026-40534?

Within 24 hours: Identify all Chrome desktop deployments and initiate emergency deployment of version 150.0.7871.47 (June 2026 Stable channel) or later. Within 7 days: Verify 100% of Chrome desktop instances are updated through your patch management system and confirm update completion in telemetry. Within 30 days: Review browser security policies and assess security logs for any suspicious system activity that may indicate exploitation attempts during the pre-patch exposure window.

Google Chrome EUVD-2026-40534

| CVE-2026-13848 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-vgq5-582f-8hxq

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs user navigation (AV:N, UI:R), no privileges (PR:N); renderer RCE gives high C/I/A but stays in the sandbox (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:23 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Forms component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser's renderer sandbox. Chromium rates the flaw High severity, CVSS 8.8, requiring only that the user visit a malicious page; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). A vendor patch is available in the June 2026 Stable channel release.

Technical ContextAI

The vulnerability lives in Chrome's Forms subsystem, the code responsible for parsing, laying out, and handling interactive HTML form controls within the Blink rendering engine. CWE-416 (Use After Free) is the root-cause class: an object is freed while a dangling reference to it remains, and subsequent access to that freed memory can be manipulated by an attacker to redirect execution or corrupt heap state. In browser renderers, use-after-free bugs are a common and powerful primitive because attacker-controlled JavaScript/HTML can precisely groom the heap to reallocate the freed slot with attacker-chosen data, converting the dangling pointer into arbitrary code execution. Per the CVE, resulting execution is confined to the renderer sandbox, meaning a separate sandbox-escape would be needed for full host compromise. Affected builds are identified by the Chromium CPE for google:chrome versions below 150.0.7871.47.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47 - update Chrome to 150.0.7871.47 or later on all desktop platforms (the fix ships in the June 2026 Stable channel release), then fully relaunch the browser so the update takes effect, since Chrome applies updates only on restart. Details are in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the Chromium issue tracker at https://issues.chromium.org/issues/517345069. Users of Chromium-based browsers should install the corresponding vendor update once the fix is merged. If patching must be delayed, compensating controls include enabling and enforcing automatic updates via enterprise policy, and reducing renderer attack surface - for example restricting browsing to trusted sites through web filtering/proxy allowlisting (trade-off: breaks access to legitimate sites), or deploying site isolation and strict script controls, understanding these reduce but do not eliminate the browse-to-exploit risk. Ensure the browser is restarted regardless, as staged updates otherwise remain inactive.