What is the CVSS score of EUVD-2026-40693?

EUVD-2026-40693 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40693?

Google Chrome for Android versions prior to 150.0.7871.47 contain a heap corruption vulnerability in the Omnibox component that could enable remote code execution when users interact with malicious…. A patch is available.

How to fix or mitigate EUVD-2026-40693?

Within 24 hours, inventory Android devices and identify systems running Chrome versions prior to 150.0.7871.47 to assess organizational exposure. Within 7 days, begin deploying Chrome 150.0.7871.47 or later, prioritizing users with access to sensitive systems or external-facing networks. Within 30 days, complete rollout across all Android devices and confirm patch adoption through mobile device management systems.

Google Chrome EUVD-2026-40693

| CVE-2026-14005 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-f385-pgp7-x78j

Denial Of Service Google Use After Free Memory Corruption Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N), no privileges (PR:N), but specific user gestures required (UI:R); renderer memory corruption yields high C/I/A with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:24 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Use-after-free in Google Chrome's Omnibox component on Android (versions prior to 150.0.7871.47) lets a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page trigger heap corruption and potentially achieve code execution in the renderer. Rated Medium by Chromium but scored CVSS 8.8 due to network reach and full CIA impact after minimal user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.17%), and SSVC records exploitation status as none.

Technical ContextAI

The flaw is CWE-416 (Use After Free) in the Omnibox - Chrome's unified address/search bar - on the Android build. A use-after-free occurs when the browser continues to reference heap memory that has already been freed, typically because object lifetime and reference tracking desynchronize during UI-driven state changes; an attacker who can influence the freed memory's reallocation can corrupt the heap and steer control flow. The affected component runs within Chromium's rendering/browser process on Android (CPE cpe:2.3:a:google:chrome:*), and exploitation here is coupled to specific user gestures interacting with the Omnibox while a malicious page is loaded, which is why user interaction is required.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47 for Android - update to this version or later via Google Play or the browser's built-in updater and restart the browser to apply. Refer to the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) and the tracked issue at https://issues.chromium.org/issues/514740273; SUSE-packaged Chromium consumers should pull the corresponding distribution update. As an interim compensating measure while updates roll out, avoid interacting with the Omnibox on untrusted pages and discourage the specific gesture sequences on unknown sites; because exploitation requires user interaction, user-awareness and prompt auto-update enrollment are effective, low-side-effect controls until the patched build is installed.