What is the CVSS score of EUVD-2026-40836?

EUVD-2026-40836 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40836?

Google Chrome on Linux versions prior to 150.0.7871.47 contain a use-after-free vulnerability in audio processing that allows remote code execution when users visit malicious websites.. A patch is available.

How to fix or mitigate EUVD-2026-40836?

Within 24 hours, identify and document the scope of Chrome deployment on Linux systems, including user count and system criticality levels. Within 7 days, deploy Chrome version 150.0.7871.47 or later to all affected Linux systems using your standard patch management process. By day 30, verify that 100% of Chrome installations on Linux have been updated and enforce version compliance through endpoint monitoring or automatic update policies.

Google Chrome EUVD-2026-40836

| CVE-2026-14149 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-68pf-rhc2-ccjg

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable via a crafted page (AV:N) but reliably grooming the heap for a use-after-free is non-trivial (AC:H); no privileges required but the victim must open the page (PR:N/UI:R).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:10 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Audio in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome on Linux prior to 150.0.7871.47 stems from a use-after-free in the Audio component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the renderer. The CVSS 8.8 rating reflects network reach with required user interaction (visiting a page), yet Chromium rated the security severity only Low and SSVC shows no observed exploitation. No public exploit is identified at time of analysis and EPSS is low at 0.24% (15th percentile).

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Audio subsystem, which handles Web Audio and media playback inside the renderer process. Use-after-free bugs occur when a pointer is retained and dereferenced after its underlying object has been freed, allowing an attacker who controls heap allocations through JavaScript/HTML to reclaim the freed slot with attacker-shaped data and hijack the subsequent use of the dangling pointer. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, specifically Chromium-based Chrome builds on Linux; the same engine underlies downstream browsers and distribution packages, and the SUSE tag reflects Linux distribution repackaging of the fix.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on Linux via the stable channel, then fully relaunch the browser so the new binary loads (Chrome stages updates but they take effect only on restart). Distribution users should apply the corresponding vendor package update (e.g., SUSE) once published. See the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If patching must be delayed, compensating controls include enforcing automatic updates via enterprise policy and reducing renderer attack surface by restricting browsing to trusted sites or blocking untrusted media/Web Audio content - with the trade-off that this can break legitimate audio and media functionality. Because exploitation requires the victim to open a malicious page, user-awareness training and web/URL filtering of untrusted links provide partial mitigation.