What is the CVSS score of EUVD-2026-40795?

EUVD-2026-40795 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40795?

Google Chrome versions prior to 150.0.7871.47 contain a remote code execution vulnerability in its PDF rendering engine that could allow attackers to execute code within the browser sandbox when…. A patch is available.

How to fix or mitigate EUVD-2026-40795?

Within 24 hours, conduct an inventory of Chrome installations across the organization and deploy a security advisory to users alerting them to the vulnerability and the availability of the patch. Within 7 days, prioritize deployment of Chrome version 150.0.7871.47 or later to all endpoints using automatic update mechanisms or manual patching depending on deployment model. Within 30 days, verify patch adoption across the environment through asset management systems and conduct retrospective security awareness briefing to users on risks associated with untrusted PDF files.

Google Chrome EUVD-2026-40795

| CVE-2026-14108 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-vvm6-rwf8-38h4

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted PDF needs no privileges but requires the victim to open it (UI:R); sandboxed execution keeps scope unchanged (S:U) while allowing full memory-corruption impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:16 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

AnalysisAI

Sandboxed remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 150.0.7871.47) lets a remote attacker corrupt memory via a crafted PDF, triggering a use-after-free (CWE-416). Exploitation requires the victim to open or view a malicious PDF (UI:R), and per the description any resulting code execution occurs inside the browser sandbox, which meaningfully constrains impact absent a separate sandbox-escape. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and CISA SSVC records exploitation status as none.

Technical ContextAI

PDFium is Chromium's open-source PDF parsing and rendering library, embedded in Chrome to display PDF files natively in the browser. The flaw is a use-after-free (CWE-416): the code continues to reference a heap object after it has been freed, allowing an attacker who controls PDF structure to influence the contents of that reclaimed memory and potentially redirect execution. Use-after-free bugs in browser rendering components are a classic memory-corruption primitive that can be developed into arbitrary code execution, though in this case Google explicitly scopes the outcome to code execution within the renderer sandbox. The only CPE provided is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, and because PDFium is shared, Chromium-derived browsers (Edge, Brave, Opera, Electron apps) may inherit the same defect until they rebase.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47 - upgrade to this Stable channel build or later per the Google advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, so ensure the browser is fully closed and relaunched to apply the update, and verify the running version via chrome://settings/help across the fleet. If immediate patching is not possible, reduce exposure by configuring Chrome to not automatically open or preview PDFs in-browser (route PDFs to a separately patched external viewer via the AlwaysOpenPdfExternally enterprise policy), which trades native in-browser PDF convenience for removing the vulnerable rendering path, and advise users not to open untrusted PDF attachments or links until updated. Users of Chromium-based browsers should apply their vendor's corresponding rebased build (e.g., SUSE package updates).