What is the CVSS score of EUVD-2026-41159?

EUVD-2026-41159 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google are affected by EUVD-2026-41159?

Google Chrome versions before 150.0.7871.46 contain a remote code execution vulnerability in the V8 JavaScript engine that could allow attackers to execute arbitrary code within the browser sandbox…. A patch is available.

How to fix or mitigate EUVD-2026-41159?

Within 24 hours: Identify and inventory Chrome desktop installations across the organization, prioritizing systems handling sensitive data. Within 7 days: Deploy Chrome 150.0.7871.46 or later through your patch management system; enable auto-update where feasible. Within 30 days: Verify 100% patch compliance through audit and implement monitoring to catch failed or deferred updates.

Google EUVD-2026-41159

| CVE-2026-14383 HIGH

Code Injection (CWE-94)

2026-07-01 Chrome

GHSA-h4v8-ph46-3vqp

Code Injection Google RCE Suse

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 02:23 vuln.today

CVSS changed

Jul 02, 2026 - 02:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jul 01, 2026 - 22:21 cve.org

HIGH 8.8

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in the V8 JavaScript engine of Google Chrome before 150.0.7871.46 allows a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code — though notably only within the renderer sandbox rather than achieving full host compromise. Rated CVSS 8.8 and stemming from a code-generation flaw (CWE-94) in V8, it affects all Chrome desktop installations on the vulnerable channel; a fix has shipped, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none.