What is the CVSS score of EUVD-2026-40555?

EUVD-2026-40555 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40555?

Google Chrome on Windows (versions prior to 150.0.7871.47) contains a sandbox-escape vulnerability that escalates privileges if an attacker has already compromised the browser's renderer process.. A patch is available.

How to fix or mitigate EUVD-2026-40555?

24 hours: Notify Windows system owners and confirm Google's patch availability. 7 days: Deploy Chrome version 150.0.7871.47 or later to all Windows endpoints via central management systems. 30 days: Complete deployment verification and confirm 100% remediation across the organization.

Google Chrome EUVD-2026-40555

| CVE-2026-13869 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-95mc-3qfr-rvgq

Denial Of Service Google Use After Free Memory Corruption Microsoft Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation requires a pre-compromised renderer and controlled heap grooming; UI:R for the crafted page; S:C and full C/I/A:H reflect the sandbox escape into the privileged browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:27 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Device component on Windows (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416). Google rates the Chromium security severity as Medium, reflecting that it is a second-stage bug requiring prior renderer compromise, though the NVD CVSS of 9.6 is inflated by the sandbox scope change. There is no public exploit identified at time of analysis and EPSS is low (0.21%), indicating no current sign of widespread exploitation.

Technical ContextAI

The flaw resides in Chrome's 'Device' subsystem (device-related Blink/browser APIs such as WebUSB/WebHID/device enumeration bridging the renderer and privileged browser process) and is a use-after-free - CWE-416 - where memory is freed but a dangling pointer is later dereferenced, allowing an attacker to reclaim the freed allocation with controlled data and corrupt object state. Because the vulnerable code path executes across the renderer/browser sandbox boundary, controlled reuse of the freed object can yield code execution in the more-privileged browser process, achieving a sandbox escape. The EUVD/CPE data scopes this strictly to Google Chrome builds below 150.0.7871.47 on Windows; other platforms are not indicated in the provided data.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on Windows via the Chrome stable channel, then fully restart the browser so the new binary loads (Chrome auto-updates but requires a relaunch to apply). The authoritative advisory is the Chrome Releases post at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. There is no standalone configuration workaround for a use-after-free memory bug, so patching is the only reliable fix; if immediate patching is not possible, reduce chainability by enforcing that Chrome is not run with a disabled sandbox (never use --no-sandbox) and by deploying site-isolation and strict update policies via enterprise management, accepting that these only raise the bar for the prerequisite renderer compromise rather than eliminating this specific bug. Restricting access to untrusted web content or device-access web APIs where feasible further limits exposure but does not remediate the underlying flaw.