What is the CVSS score of EUVD-2026-41155?

EUVD-2026-41155 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-41155?

A critical vulnerability in Google Chrome for macOS (CVE-2026-14385) could allow remote attackers to compromise systems when users visit a malicious website.. A patch is available.

How to fix or mitigate EUVD-2026-41155?

Within 24 hours, identify your macOS Chrome user population and determine your primary update mechanism (corporate MDM, auto-update policies, or manual distribution). Within 7 days, push Chrome version 150.0.7871.46 or later to all affected macOS systems through your chosen deployment method and monitor for successful installations. Within 30 days, verify patching compliance across your macOS estate and review security logs for any exploitation attempts.

Google Chrome EUVD-2026-41155

| CVE-2026-14385 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-01 Chrome

GHSA-wf3x-w2h2-vmgf

Buffer Overflow Google Heap Overflow Red Hat

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no auth (AV:N/PR:N/AC:L) but requires the victim to open it (UI:R); renderer heap corruption yields high C/I/A within unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:45 vuln.today

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds memory access in Google Chrome's ANGLE graphics component on macOS lets a remote attacker corrupt heap memory when a victim opens a crafted HTML page in versions before 150.0.7871.46. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a page) but no authentication; there is no public exploit identified at time of analysis and it is not on CISA KEV, with a low EPSS of 0.21% (11th percentile). A vendor patch is available.

Technical ContextAI

The flaw resides in ANGLE (Almost Native Graphics Layer Engine), the translation layer Chrome uses to map WebGL/OpenGL ES calls onto the host platform's native graphics API - on macOS this backs onto Metal/OpenGL. CWE-122 (Heap-Based Buffer Overflow) identifies the root cause: a graphics operation driven by attacker-controlled HTML/WebGL content writes or reads beyond an allocated heap buffer, producing out-of-bounds memory access. Because ANGLE processes untrusted GPU commands from web content inside the renderer, memory-safety defects here are a recurring and high-value class in browser exploitation. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome application itself, with this specific issue scoped to the macOS build.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later on macOS via the Chrome Stable channel; Chrome typically auto-updates, so relaunch the browser to apply the pending update and verify the version under About Google Chrome. The vendor advisory is https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the issue tracker reference is https://issues.chromium.org/issues/499006005. If patching must be delayed on managed macOS fleets, reduce exposure by restricting untrusted web browsing and, where feasible, disabling hardware-accelerated graphics / WebGL to shrink the ANGLE attack surface - note this degrades rendering performance and breaks WebGL-based sites, so it is a temporary control only until the update is deployed. Enterprise administrators can enforce the minimum version through Chrome Browser Cloud Management update policies.