What is the CVSS score of EUVD-2026-40539?

EUVD-2026-40539 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40539?

Google Chrome versions before 150.0.7871.47 contain a sandbox escape vulnerability (CVSS 9.6) in the Journeys component that allows attackers who have already compromised the renderer process to gain…. A patch is available.

How to fix or mitigate EUVD-2026-40539?

Within 24 hours: Identify all Chrome deployments in your environment and validate current version levels. Within 7 days: Deploy Chrome 150.0.7871.47 or later via your patch management system, prioritizing systems where users handle untrusted content. Within 30 days: Verify deployment completion across your fleet and monitor endpoint logs for exploitation indicators (renderer process crashes, unexpected child processes from Chrome).

Google Chrome EUVD-2026-40539

| CVE-2026-13853 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-m653-2xr7-9jjx

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a pre-compromised renderer (PR:L) and chaining plus victim page load (AC:H, UI:R); successful escape crosses into the browser process (S:C) with full host impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:23 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Journeys (browsing history) component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader code execution on the host via a crafted HTML page. Rated High severity by Chromium and CVSS 9.6, a fix is available from vendor; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Exploitation is meaningful only as the second stage of a chain, since it presupposes prior renderer compromise.

Technical ContextAI

The flaw is a CWE-416 Use After Free in Chrome's Journeys feature, the clustering/grouping subsystem that organizes browsing history into thematic 'journeys' in the browser process. Use-after-free occurs when memory is referenced after being freed, letting an attacker reuse or reallocate that memory to corrupt object state and hijack control flow. Because Journeys logic runs in the privileged browser process rather than the sandboxed renderer, a dangling pointer here is a classic sandbox-escape primitive: a malicious renderer feeds crafted data across the IPC boundary to trigger the free-then-use condition in the higher-privilege process. The affected CPE space is Google Chrome for desktop (Windows/macOS/Linux) at versions below 150.0.7871.47; tags also cite Denial of Service and Memory Corruption, consistent with UAF behavior that can either crash or be shaped into code execution.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms via the Chrome Releases Stable Channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); relaunch the browser to apply the update since Chrome staged updates only take effect after restart. In managed fleets, push the update through your enterprise deployment tooling and verify the running version rather than the installed version. Users of Chromium-based browsers should update to the release that incorporates the corresponding upstream fix. As an interim compensating control before patching, restrict exposure to untrusted web content and consider enabling site isolation and stricter renderer hardening (already default in Chrome) to raise the bar for the prerequisite renderer compromise; there is no feature-level toggle for Journeys that reliably neutralizes this UAF, so patching is the definitive remediation and workarounds only reduce, not eliminate, the risk.