What is the CVSS score of EUVD-2026-40566?

EUVD-2026-40566 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40566?

Google Chrome versions prior to 150.0.7871.47 on macOS contain a sandbox escape vulnerability (CVE-2026-13880) that could allow attackers to escalate from browser compromise to full system access.. A patch is available.

How to fix or mitigate EUVD-2026-40566?

Within 24 hours, inventory all macOS systems running Google Chrome and identify any running versions prior to 150.0.7871.47. Within 7 days, deploy Chrome update to version 150.0.7871.47 or later across all affected macOS endpoints; prioritize systems with elevated network access or sensitive data. Within 30 days, verify deployment completion through patch compliance reporting and validate that no systems remain on vulnerable versions.

Google Chrome EUVD-2026-40566

| CVE-2026-13880 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-mcvv-vhh3-wrjh

Denial Of Service Google Use After Free Memory Corruption Red Hat

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Raised AC to High because exploitation requires a pre-compromised renderer plus winning a use-after-free race; scope changes (S:C) via sandbox escape with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:54 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's USB subsystem on macOS (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and was reported by Google's own security team; Chromium rated it Medium severity despite the NVD CVSS of 9.6. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 11th percentile), consistent with a chained/second-stage bug rather than a directly weaponizable entry point.

Technical ContextAI

The vulnerability lives in Chrome's WebUSB/USB implementation, the browser-side component that brokers access between web content and physical USB devices. A use-after-free (CWE-416) occurs when USB-related object memory is freed but a dangling reference is subsequently reused, letting an attacker corrupt memory in a more-privileged browser process. Because WebUSB device brokering runs outside the renderer sandbox, corrupting it enables a sandbox escape - the renderer's constrained process gains the ability to influence higher-privileged code. The CPE (cpe:2.3:a:google:chrome) confirms the affected product is the Chrome application, and the description scopes impact specifically to the macOS build.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on macOS via the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); Chrome's auto-update will apply this on relaunch, so ensure users fully restart the browser rather than leaving long-lived sessions open. As an interim compensating control until updates propagate, restrict WebUSB exposure via enterprise policy - the DefaultWebUsbGuardSetting policy (set to 2, block) disables sites' access to USB devices, which reduces the attack surface of the USB code path at the cost of breaking legitimate WebUSB applications (e.g., hardware security keys managed via WebUSB, firmware-flashing tools). Because exploitation requires a pre-compromised renderer, maintaining site isolation and prompt patching of any renderer-level RCE bugs is the more impactful control.