What is the CVSS score of EUVD-2026-40780?

EUVD-2026-40780 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40780?

Google Chrome versions prior to 150.0.7871.47 contain a sandbox escape vulnerability that could allow attackers with pre-existing renderer process access to gain full system access.. A patch is available.

How to fix or mitigate EUVD-2026-40780?

Within 24 hours: Inventory all deployed Chrome versions in your organization and prioritize systems with Chrome versions prior to 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later via your standard patch management process. Within 30 days: Confirm 100% deployment completion and monitor threat feeds for any exploitation indicators of this vulnerability.

Google Chrome EUVD-2026-40780

| CVE-2026-14093 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-wrqf-wjm9-27cw

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Requires a pre-existing renderer compromise plus a crafted page, so AC:H; delivered over the web with user interaction (UI:R), and a successful sandbox escape yields full impact with scope change.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:23 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome's Cast component (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory-corruption bug. Google's Chromium team rated the security severity as Low, and while NVD assigns a 9.6 CVSS reflecting full sandbox-escape impact, exploitation is gated behind a pre-existing renderer compromise. No public exploit was identified at time of analysis, EPSS is very low at 0.17% (7th percentile), and there is no CISA KEV listing.

Technical ContextAI

The flaw resides in Chrome's Cast subsystem, which discovers and streams content to Chromecast and other Cast-enabled receivers. The root cause is a use-after-free (CWE-416): a heap object is freed while a dangling reference remains reachable, and subsequent access to that stale reference lets an attacker corrupt memory and manipulate control flow. In Chrome's multi-process model, renderer processes are sandboxed and the privileged browser process mediates OS access; a use-after-free reachable from a compromised renderer that operates on browser-process Cast objects provides a path to escape that sandbox. The affected CPE surface is the Chrome desktop browser (Windows/macOS/Linux stable channel) at builds below 150.0.7871.47.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on the stable desktop channel, as published in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); most installations receive this automatically, so verify the update applied and relaunch Chrome to complete it. In managed fleets, push the update via enterprise browser policy and enforce the minimum version. Where immediate patching is not possible, the specific compensating control is to reduce the Cast attack surface by disabling media routing/Cast (for example via the MediaRouterEnabled enterprise policy set to false), which removes the vulnerable code path but breaks casting of tabs and media to Chromecast/receiver devices. Because exploitation requires a prior renderer compromise, keeping site isolation and the sandbox enabled and blocking untrusted web content further limits the chain.