What is the CVSS score of EUVD-2026-41205?

EUVD-2026-41205 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-41205?

Google Chrome versions prior to 150.0.7871.46 contain a use-after-free vulnerability in the V8 JavaScript engine enabling remote code execution when users visit malicious webpages, creating…. A patch is available.

How to fix or mitigate EUVD-2026-41205?

Within 24 hours: Audit Chrome deployment across organization and alert all users of critical update requirement. Within 7 days: Deploy Chrome 150.0.7871.46 or later via endpoint management systems (MDM/Intune/Google Admin Console) and verify rollout completion. Within 30 days: Achieve 100% compliance verification through device inventory systems and escalate non-compliant devices to IT leadership.

Google Chrome EUVD-2026-41205

| CVE-2026-14394 HIGH

Use After Free (CWE-416)

2026-07-01 Chrome

GHSA-qh8v-j89h-883x

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–High)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page (AV:N) with low complexity requires the victim to visit it (UI:R), no auth (PR:N); use-after-free yields potential full renderer compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 16:00 vuln.today

CVSS changed

Jul 02, 2026 - 13:52 NVD

8.8 (HIGH)

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:22 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution risk in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.46) arises from a use-after-free that a remote attacker can trigger by luring a victim to a crafted HTML page, leading to heap corruption and potential arbitrary code execution in the renderer. The CVSS 8.8 rating reflects high impact with only user interaction (visiting a page) required, though Google rated the Chromium security severity as Low and no public exploit is identified at time of analysis. EPSS is low at 0.18% (8th percentile) and CISA SSVC records no known exploitation.

Technical ContextAI

The flaw lives in V8, the C++ JavaScript and WebAssembly engine embedded in Chromium-based browsers, and is classified as CWE-416 (Use After Free): code retains and dereferences a pointer to heap memory that has already been freed, allowing an attacker who controls subsequent heap allocations to corrupt object state and hijack control flow. Because V8 executes untrusted JavaScript from any visited page, a malicious script can groom the heap to reoccupy the freed region with attacker-controlled data. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*; the same V8 code is shared across other Chromium derivatives (Edge, Brave, Opera, Electron apps), which typically inherit the fix downstream.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later via the Stable channel and relaunch the browser to apply it (see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Most installations auto-update, but administrators should confirm the rollout across managed fleets and force a restart, since the fix is inactive until Chrome is relaunched. Users of other Chromium-based browsers should apply their vendor's corresponding V8 update as it becomes available. As an interim compensating control on unpatched hosts, restrict browsing to trusted sites or disable JavaScript for untrusted origins (which breaks most modern web functionality) and consider site-isolation/renderer-hardening enterprise policies; these reduce but do not eliminate exposure, so prompt patching remains the reliable fix.