What is the CVSS score of EUVD-2026-41200?

EUVD-2026-41200 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-41200?

A critical vulnerability in Google Chrome's WebGPU component (CVE-2026-14417, CVSS 9.6) affects all desktop users prior to version 150.0.7871.46, allowing attackers to bypass browser security…. A patch is available.

How to fix or mitigate EUVD-2026-41200?

Within 24 hours: Issue mandatory update notice; ensure automatic updates are enabled. Within 7 days: Verify Chrome 150.0.7871.46 or later is deployed enterprise-wide; audit any endpoints on older versions. Within 30 days: Confirm 100% patch compliance and document remediation.

Google Chrome EUVD-2026-41200

| CVE-2026-14417 CRITICAL

Use After Free (CWE-416)

2026-07-01 Chrome

GHSA-c6m6-6997-fxfh

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-reachable via a web page with only user interaction (UI:R) and no privileges; the use-after-free enables a sandbox escape, so scope changes (S:C) with high C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:23 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:22 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's Dawn (WebGPU) component affects all desktop builds prior to 150.0.7871.46, where a use-after-free lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity Critical, and the CVSS 3.1 score of 9.6 reflects a scope-changing memory-corruption bug. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is already shipping in the Stable channel.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU API, which exposes GPU compute and rendering to web content through JavaScript. Because Dawn processes attacker-influenced GPU command buffers and object lifetimes on behalf of untrusted web pages, memory-safety errors in it are especially dangerous. This issue is CWE-416 (Use After Free): an object is freed while a reference to it is still used, letting an attacker reclaim and control the freed memory to corrupt state. Given the S:C (scope change) in the CVSS vector, exploitation targets the boundary between the sandboxed renderer and higher-privileged browser/GPU process, i.e. a sandbox escape rather than a simple renderer crash. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across desktop platforms.

RemediationAI

Vendor-released patch: update to Google Chrome 150.0.7871.46 or later on Windows, macOS, and Linux; the fix is delivered through the Stable channel and takes effect on browser restart, so ensure Chrome is fully relaunched to complete the update. See the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Where immediate patching is not possible, the practical compensating control is to disable the WebGPU attack surface via chrome://flags/#enable-unsafe-webgpu and related WebGPU flags or enterprise policies, which prevents Dawn from processing untrusted GPU workloads at the cost of breaking legitimate WebGPU sites and GPU-accelerated web applications. Enterprise fleets should push the updated version through managed update policies rather than relying on user-initiated restarts.