What is the CVSS score of EUVD-2026-41165?

EUVD-2026-41165 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-41165?

Google Chrome users across your organization face critical risk from a newly-disclosed renderer sandbox bypass (CVE-2026-14382, CVSS 9.6) that requires only viewing a malicious webpage to trigger.. A patch is available.

How to fix or mitigate EUVD-2026-41165?

Within 24 hours: Push emergency update mandate to Google Chrome version 150.0.7871.46 or later; verify Chrome auto-update is enabled in all enterprise policies and notify users of affected BYOD devices to update immediately. Within 7 days: Audit deployment status and confirm 100% remediation across managed endpoints; document any exceptions for executive risk acceptance. Within 30 days: Review browser access and endpoint logs for indicators of exploitation attempts targeting the ANGLE graphics vulnerability; correlate with any suspicious user activity during pre-patch window.

Google Chrome EUVD-2026-41165

| CVE-2026-14382 CRITICAL

Improper Input Validation (CWE-20)

2026-07-01 Chrome

GHSA-7fh8-qj6w-5vcc

Information Disclosure Google Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs no privileges but requires the user to visit (UI:R); sandbox escape crosses a security boundary (S:C) enabling full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:30 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.46) lets a remote attacker break out of the renderer sandbox when a victim visits a crafted HTML page. The flaw stems from insufficient validation of untrusted input (CWE-20) in ANGLE and carries a critical 9.6 CVSS score due to the scope-changing sandbox escape. Google has shipped a fix and rates the Chromium severity as High; there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's abstraction that translates OpenGL ES / WebGL calls to the host platform's native graphics API (Direct3D, Metal, Vulkan, or desktop GL). Because ANGLE processes attacker-influenced graphics commands originating from web content, a validation gap (CWE-20, Improper Input Validation) in this layer can let malformed inputs corrupt state or bypass boundary checks. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, meaning all desktop Chrome builds before 150.0.7871.46. A sandbox escape here is severe because the renderer process is normally the primary security boundary confining web-originated code; escaping it grants access to the more privileged browser process context.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later via the Stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; trigger 'About Google Chrome' to force the update and relaunch to apply it, since a running browser retains the vulnerable code until restarted. In managed fleets, push the update through enterprise policy/management tooling and enforce browser relaunch. If patching cannot be completed immediately, reduce exposure by restricting browsing to trusted sites and, where feasible, disabling hardware-accelerated graphics/WebGL (chrome://settings 'Use graphics acceleration when available' off, or the disable-3d-apis policy) to limit reachability of the ANGLE code path - the trade-off is degraded rendering performance and broken WebGL-dependent sites, so this is a temporary control only until the update lands.