What is the CVSS score of EUVD-2026-41187?

EUVD-2026-41187 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-41187?

Google Chrome desktop contains a critical sandbox escape vulnerability (CVE-2026-14423, CVSS 9.6) affecting all versions prior to 150.0.7871.46 that could allow attackers to execute arbitrary code…. A patch is available.

How to fix or mitigate EUVD-2026-41187?

Within 24 hours: Identify Chrome desktop deployment scope and establish patch deployment timeline across endpoints. Within 7 days: Deploy Chrome 150.0.7871.46 or later via your patch management system to all affected Windows, macOS, and Linux systems; prioritize endpoints with elevated privileges or sensitive data access. Within 30 days: Confirm complete remediation by scanning environment for Chrome versions below 150.0.7871.46 and document compliance status.

Google Chrome EUVD-2026-41187

| CVE-2026-14423 CRITICAL

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-01 Chrome

GHSA-7wm2-2f2v-872x

Information Disclosure Google Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs user to visit (UI:R) but no auth (PR:N); sandbox escape breaks the containment boundary (S:C) with total host impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:22 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

CRITICAL 9.6

DescriptionCVE.org

Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape via type confusion in Tint, the WGSL shader compiler within Chrome's Dawn/WebGPU stack, affects Google Chrome desktop versions prior to 150.0.7871.46. A remote attacker who lures a victim to a crafted HTML page can trigger the flaw (CWE-843) to potentially break out of the renderer/GPU sandbox and gain broader access on the host. Rated High by Chromium with a CVSS 9.6 (scope-changed), though there is no public exploit identified at time of analysis and CISA SSVC currently records exploitation status as 'none'.

Technical ContextAI

Tint is Google's WGSL (WebGPU Shading Language) compiler, part of the Dawn WebGPU implementation shipped in Chrome. It parses and compiles shader programs supplied by web content into backend GPU code, typically running inside the GPU process. The root cause is CWE-843 (Type Confusion): the compiler interprets a piece of memory or an object as one type when it is actually another, allowing attacker-controlled shader input to violate type-safety assumptions and corrupt memory. Because WebGPU exposes this compilation path directly to untrusted JavaScript/HTML, a malicious page can feed crafted shader constructs to reach the confused code path. The CPE cpe:2.3:a:google:chrome:*:* confirms the Chrome application as the affected product, and the vendor-supplied tags (Memory Corruption, Information Disclosure) align with type confusion primitives that can yield read/write and control-flow corruption leading to sandbox escape.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later on the Stable channel; Chrome normally auto-updates, so verify the version under chrome://settings/help and relaunch to apply, and push the update through enterprise management (GPO/MDM) to guarantee coverage across the fleet, per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users of Chromium-based browsers should apply their vendor's update once it incorporates the fixed Chromium build. As a compensating control until patched, disable hardware-accelerated WebGPU to remove the vulnerable Tint compilation path - set the 'Unsafe WebGPU Support' / WebGPU flags to disabled via chrome://flags or enterprise policy, or disable GPU acceleration entirely (chrome://settings 'Use graphics acceleration when available'); the trade-off is degraded graphics/3D and WebGPU-dependent site functionality and potential performance loss. Additionally, avoiding untrusted sites and enforcing site isolation reduces exposure, since exploitation requires the victim to load attacker-controlled HTML.