What is the CVSS score of EUVD-2026-40620?

EUVD-2026-40620 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40620?

Google Chrome for Android contains a critical vulnerability (CVE-2026-13934, CVSS 9.6) enabling sandbox bypass that could lead to complete device compromise when exploited in multi-stage attacks.. A patch is available.

How to fix or mitigate EUVD-2026-40620?

Within 24 hours, conduct an inventory audit of Android Chrome deployments across managed and BYOD devices and issue a security alert to all users. Within 7 days, deploy Google Chrome 150.0.7871.47 or later across all Android devices using MDM platforms or app distribution channels, verifying deployment completion. Over the following 30 days, monitor device logs for exploitation attempts, conduct post-patch compliance audits, and update incident response procedures to account for multi-stage mobile attack chains.

Google Chrome EUVD-2026-40620

| CVE-2026-13934 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-4r63-54pq-wf8p

Information Disclosure Google Red Hat

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because a prior renderer compromise is a mandatory precondition; UI:R for page load; S:C and full C/I/A as a successful sandbox escape yields total host compromise.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

7.9 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:50 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Dawn (WebGPU) implementation on Android before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox and reach the host via a crafted HTML page. Reported by Google's own Chrome security team and rated Medium by Chromium despite an NVD CVSS of 9.6, it currently has no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile). It is a second-stage bug that requires a prior renderer compromise, so it is dangerous as part of an exploit chain rather than as a standalone entry point.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU standard, which exposes low-level GPU compute and rendering to web content and runs partly inside the sandboxed renderer/GPU process. The root cause is classified as CWE-20 (Improper Input Validation): Dawn insufficiently validates untrusted input crossing the renderer-to-GPU/browser boundary, so data controlled by an already-compromised renderer can be interpreted unsafely by a more privileged process. Because WebGPU deliberately surfaces complex driver and GPU state to untrusted JavaScript, its IPC and command validation layers are a recurring sandbox-escape surface. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scopes this to the Chrome application, and the CVE description narrows real-world exposure specifically to Chrome on Android prior to 150.0.7871.47.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 150.0.7871.47 or later, which is the primary and recommended fix per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); on Android this arrives via Google Play, so ensure automatic app updates are enabled and verify the installed version. There is no supported per-feature toggle to disable Dawn/WebGPU on Android, so no clean standalone workaround exists; because exploitation requires a pre-existing renderer compromise, the most effective compensating control is to reduce the odds of that first-stage compromise - keep the whole browser current, avoid sideloaded or outdated Chrome builds, and in managed fleets use enterprise policy to enforce minimum browser versions. On desktop/managed deployments where WebGPU is not needed, disabling GPU/WebGPU features reduces attack surface at the cost of breaking WebGPU-dependent sites, but this option is limited on Android.