What is the CVSS score of EUVD-2026-40587?

EUVD-2026-40587 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40587?

Google Chrome desktop versions before 150.0.7871.47 contain a critical sandbox escape vulnerability in the Web Serial API that could enable renderer code execution to break out of browser isolation…. A patch is available.

How to fix or mitigate EUVD-2026-40587?

Within 24 hours: Inventory all Chrome desktop deployments, identify systems running versions before 150.0.7871.47, and assess business-critical workstations and shared systems. Within 7 days: Deploy Chrome 150.0.7871.47 or later via standard patch management, prioritizing systems handling sensitive workloads or untrusted content. Within 30 days: Verify 100% deployment coverage across all Chrome instances, document remediation completion, and review browser isolation controls in security configurations.

Google Chrome EUVD-2026-40587

| CVE-2026-13901 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-7pqf-g2j2-j5x4

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because a pre-existing renderer compromise is required; UI:R for page interaction and S:C/C:H/I:H/A:H reflect the full sandbox escape into the browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:29 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who already controls a compromised renderer process break out of the browser sandbox through insufficient policy enforcement in the Web Serial API, using a crafted HTML page. Google rated the underlying Chromium bug Medium severity even though NVD assigns a 9.6 CVSS due to the scope-changing impact. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.22%, 12th percentile).

Technical ContextAI

The flaw lives in Chrome's implementation of the Web Serial API (the 'Serial' component), which brokers page access to serial/COM devices across the renderer-to-browser process boundary. CWE-20 (Improper Input Validation) here manifests as insufficient policy enforcement: the trusted browser-process side of the Serial mediation does not adequately validate or constrain requests coming from the less-trusted renderer, so a renderer that an attacker has already subverted can drive the Serial pathway in ways that cross the sandbox boundary. Chrome's multi-process security model relies on the browser process strictly policing all IPC from renderers; a lapse in that enforcement for a device-access feature undermines the sandbox that is supposed to contain renderer compromises. Per EUVD the affected build train is the 150.x desktop stable channel prior to 150.0.7871.47.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47 - upgrade all desktop Chrome installs to 150.0.7871.47 or later and restart the browser to apply the update (Chrome auto-updates, but relaunch is required to load the new binary; verify via chrome://settings/help in managed fleets). See the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As an interim compensating control until the update is confirmed applied, restrict the Web Serial attack surface via enterprise policy: set DefaultSerialGuardSetting to 2 (block sites from requesting serial-port access) and/or use SerialAllowAllPortsForUrls/SerialBlocklist to deny serial access broadly - the trade-off is that legitimate web apps relying on serial-device access (e.g. hardware provisioning, IoT, or lab tooling) will stop working. Because exploitation presupposes a compromised renderer, also keep site isolation enabled and prioritize patching any co-triggering renderer RCE bugs from the same release.