What is the CVSS score of EUVD-2026-41173?

EUVD-2026-41173 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-41173?

Google Chrome versions prior to 150.0.7871.46 contain a sandbox escape in the Skia graphics library that allows attackers who have compromised the renderer process to gain full system-level access.. A patch is available.

How to fix or mitigate EUVD-2026-41173?

Within 24 hours: Deploy Chrome 150.0.7871.46 or later to all endpoints, prioritizing systems with access to sensitive data. Within 7 days: Complete organization-wide update and verify deployment completion. Within 30 days: Audit endpoint inventory to confirm zero instances of Chrome versions before 150.0.7871.46 remain in active use.

Google Chrome EUVD-2026-41173

| CVE-2026-14389 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-07-01 Chrome

GHSA-rxcx-qr4q-hf9m

Buffer Overflow Google Red Hat Suse

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a prior renderer compromise, so PR:L rather than PR:N; AC:H for the chaining/complexity and UI:R for loading the page; S:C and C/I/A:H reflect the total-impact sandbox escape.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:29 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

8.3 (HIGH)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

HIGH 8.3

DescriptionCVE.org

Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Skia graphics library (versions before 150.0.7871.46) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated Medium by Chromium but scored CVSS 8.3 due to scope change and total impact; there is no public exploit identified at time of analysis and SSVC reports no observed exploitation. Realistically it is a second-stage bug that must be chained with a prior renderer compromise, which raises the practical difficulty.

Technical ContextAI

Skia is the open-source 2D graphics rendering engine used across Chrome (and Chromium-derived browsers, Android, and other Google products) to rasterize web content, canvas, and compositing operations. The root cause is an integer overflow (the description states integer overflow; the assigned CWE-472 and 'Buffer Overflow' tag are inconsistent with that and appear mislabeled - an integer-overflow-to-buffer-overflow class such as CWE-190 fits the description better). In practice a miscomputed size/length in Skia allocation or bounds math leads to memory corruption that, from within the already-compromised renderer, can be leveraged to escape the browser sandbox. The affected component (cpe:2.3:a:google:chrome) is the desktop Chrome browser.

RemediationAI

Vendor-released patch: 150.0.7871.46 - update Google Chrome to 150.0.7871.46 or later via the Stable channel and restart the browser to apply it; verify rollout at chrome://settings/help and confirm your fleet's auto-update is enabled so the fix lands without manual action (advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html, tracking bug: https://issues.chromium.org/issues/500505046). Because exploitation requires a prior renderer compromise, effective compensating controls until patched target that first stage: enable Chrome's site isolation (default) and the enhanced/strict sandbox, deploy enterprise policies to restrict untrusted browsing, and consider enabling the memory-safety mitigations and disabling unnecessary hardware/GPU acceleration paths that exercise Skia - noting that disabling GPU acceleration degrades rendering performance and is only a temporary stopgap. Chromium-based browser users should apply their vendor's corresponding update once available.