What is the CVSS score of EUVD-2026-41175?

EUVD-2026-41175 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-41175?

Google Chrome versions prior to 150.0.7871.46 contain a critical sandbox escape vulnerability in the WebGPU implementation that allows arbitrary code execution on employee workstations through a…. A patch is available.

How to fix or mitigate EUVD-2026-41175?

Within 24 hours: Audit deployed Chrome versions across the organization and identify systems running versions earlier than 150.0.7871.46. Within 7 days: Deploy Chrome 150.0.7871.46 or later to all affected systems via your standard patch management process; prioritize endpoints in high-risk roles (finance, engineering, executives). Within 30 days: Verify 100% patch compliance through automated inventory scans and monitor security logs for exploitation attempts targeting WebGPU functionality.

Google Chrome EUVD-2026-41175

| CVE-2026-14420 CRITICAL

Out-of-bounds Read (CWE-125)

2026-07-01 Chrome

GHSA-g9cr-jqjw-cv33

Google Buffer Overflow Information Disclosure Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs no auth (PR:N) but requires the user to visit it (UI:R); the sandbox escape crosses a trust boundary (S:C) with total memory-corruption impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:22 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

CRITICAL 9.6

DescriptionCVE.org

Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's Dawn WebGPU implementation prior to 150.0.7871.46 lets a remote attacker use a crafted HTML page to trigger an out-of-bounds read and write, potentially breaking out of the renderer sandbox. Rated Critical by Chromium with a CVSS of 9.6 (scope-changed), it requires the victim to visit a malicious page but no authentication. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to crafted HTML page

Delivery

Deliver malicious WebGPU/JavaScript payload

Exploit

Trigger OOB read/write in Dawn

Execution

Corrupt GPU process memory

Persist

Escape renderer sandbox

Impact

Execute code on host

Access

Lure victim to crafted HTML page

Delivery

Deliver malicious WebGPU/JavaScript payload

Exploit

Trigger OOB read/write in Dawn

Execution

Corrupt GPU process memory

Persist

Escape renderer sandbox

Impact

Execute code on host

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to visit or be redirected to an attacker-controlled HTML page (UI:R user interaction), and the browser must process the crafted WebGPU content in the Dawn component - WebGPU must be enabled (it is on by default in modern Chrome). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals partially conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page containing crafted WebGPU/JavaScript that drives Dawn into an out-of-bounds read and write in the GPU process; when a victim is lured to visit it, the memory corruption is triggered. Chained with the OOB write primitive, the attacker could corrupt process memory to escape the renderer sandbox and gain broader code execution on the host. …
Remediation	Vendor-released patch: update Google Chrome to 150.0.7871.46 or later via the Stable channel (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); relaunch the browser to complete the update since Chrome does not apply the fix until restart. … Detailed patch versions, workarounds, and compensating controls in full report.