What is the CVSS score of EUVD-2026-40547?

EUVD-2026-40547 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40547?

Google Chrome before version 150.0.7871.47 contains a use-after-free vulnerability that allows attackers to escape the browser sandbox and gain unrestricted access to the underlying operating system,…. A patch is available.

How to fix or mitigate EUVD-2026-40547?

Within 24 hours: Audit Chrome version distribution across all endpoints and communicate patch requirement to all users. Within 7 days: Deploy Chrome version 150.0.7871.47 or later to 90% of systems, prioritizing those with network access to sensitive assets. Within 30 days: Achieve 99% patch coverage and verify via endpoint detection and response (EDR) tools that no systems remain on vulnerable versions prior to 150.0.7871.47.

Google Chrome EUVD-2026-40547

| CVE-2026-13861 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-5xwg-4cjr-7prr

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Requires a pre-existing renderer compromise, so PR:L rather than PR:N; UI:R for the crafted page and S:C for the sandbox-boundary escape with full host C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

5.7 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:24 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page, exploiting a use-after-free (CWE-416) in the Core component. Google-assigned Chromium severity is Medium, though the NVD CVSS is 9.6 due to the cross-boundary scope change. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), indicating it is not yet a mass-exploitation target.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Chrome's 'Core' component, a class of memory-corruption bug where a pointer to freed heap memory is reused, letting an attacker groom the heap to control the freed object and corrupt adjacent state. In Chrome's multi-process architecture, untrusted web content runs inside a sandboxed renderer; a use-after-free in a browser-side or privileged path that a compromised renderer can reach becomes a sandbox-escape primitive, moving the attacker from the confined renderer into the more privileged browser process on the host. The affected CPE is Google Chrome desktop builds prior to 150.0.7871.47 (Chromium-based), so downstream Chromium browsers on the same engine version may share the defect.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47 - upgrade to this Stable-channel build or later immediately (verify via chrome://settings/help, which auto-updates and prompts for a relaunch); reference the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In managed enterprise fleets, push the updated version through your existing Chrome update policy/MSI/MDM and force a browser relaunch, since the fix only takes effect after restart. There is no supported configuration workaround for a memory-corruption sandbox escape; as an interim compensating control until patching completes, reduce the renderer-compromise attack surface by keeping the Site Isolation defaults enabled and restricting users from disabling automatic updates - note this only lowers the odds of the prerequisite renderer compromise and does not remediate the use-after-free itself. Users of downstream Chromium browsers should update those to the vendor build incorporating the same upstream fix.