What is the CVSS score of EUVD-2026-40584?

EUVD-2026-40584 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-40584?

Google Chrome versions prior to 150.0.7871.47 contain a use-after-free vulnerability in the Cast Receiver component that enables remote code execution when users visit malicious webpages, creating…. A patch is available.

How to fix or mitigate EUVD-2026-40584?

Within 24 hours: Initiate inventory of Chrome versions across all managed desktops and identify systems running versions prior to 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later organization-wide via enterprise patch management system; push policy updates to enforce minimum version 150.0.7871.47; ensure forced auto-update is enabled in your Chrome deployment configuration. Within 30 days: Validate 100% compliance through vulnerability scanning, document remediation completion in your patch management system, and close the finding from your risk register.

Google Chrome EUVD-2026-40584

| CVE-2026-13898 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-4vc8-xh76-x4r3

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page, no privileges but required user interaction (UI:R); use-after-free fully compromises the sandboxed process, so S:U with C/I/A High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.6 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:28 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Cast Receiver in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandboxed remote code execution in Google Chrome's Cast Receiver component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by luring a victim to a crafted HTML page. Google rates the Chromium severity as Medium because the resulting code execution is confined to the browser sandbox, though NVD scores it CVSS 8.8; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.27% (18th percentile).

Technical ContextAI

The flaw lives in Chrome's Cast Receiver, the Chromium subsystem that lets a device receive and render media/mirroring sessions from the Google Cast protocol. A use-after-free (CWE-416) occurs when a heap object is freed but a dangling pointer to it is later dereferenced; an attacker who controls page content can groom the heap so the freed memory is reallocated with attacker-chosen data, converting the dangling reference into a controlled read/write and ultimately control-flow hijack. Because Chrome renders untrusted web content inside a multi-process sandbox, the achieved execution is contained to the sandboxed process rather than the host OS, which matches Google's Medium rating and the CVSS scope-unchanged (S:U) metric.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel; on managed fleets, force the browser relaunch so the update actually applies, since Chrome stages updates but requires a restart. The authoritative advisory is https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If patching must be delayed, reduce exposure by disabling or restricting Google Cast/media-router functionality via enterprise policy (e.g., the EnableMediaRouter and related cast policies), which removes the vulnerable Cast Receiver attack surface at the cost of breaking screen-casting for users, and by enforcing site isolation and current sandbox settings so any triggered code stays contained. Chromium-based browsers should be updated to the release that incorporates the fixed Chromium version once published.