What is the CVSS score of EUVD-2026-47573?

EUVD-2026-47573 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-47573?

Google Chrome contains a critical stack overflow vulnerability (CVSS 8.8) affecting all desktop versions prior to 150.0.7871.182; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate EUVD-2026-47573?

Within 24 hours: Issue an urgent update notification to all Chrome users instructing immediate upgrade to version 150.0.7871.182 or later; prioritize systems with administrative privileges or handling sensitive data. Within 7 days: Use endpoint management systems to verify Chrome 150.0.7871.182 or later is deployed across all desktop assets; enforce automatic Chrome updates to prevent similar delays in future patch deployment. Within 30 days: Conduct incident response activities on any systems that cannot confirm update compliance during the vulnerability window; review network and process logs for evidence of exploitation attempts; assess whether employees accessed potentially compromised websites during the exposure period.

Google Chrome EUVD-2026-47573

| CVE-2026-16418 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-21 chrome-cve-admin@google.com

GHSA-mrwj-q3p7-wc59

RCE Buffer Overflow Google Stack Overflow

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

User interaction required to visit malicious page; no auth needed; sandbox containment keeps scope unchanged with full renderer-level C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 12:01 vuln.today

CVSS changed

Jul 24, 2026 - 13:22 NVD

8.8 (HIGH)

CVE Published

Jul 21, 2026 - 23:16 cve.org

HIGH 8.8

CVE Published

Jul 21, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Stack buffer overflow in V8, Chrome's JavaScript engine, enables remote code execution confined to the renderer sandbox when a victim visits a specially crafted HTML page. Affects all Google Chrome releases prior to 150.0.7871.182 on all desktop platforms. No public exploit code or active exploitation has been confirmed at time of analysis; vendor-released patch 150.0.7871.182 is available and should be applied immediately given the broad attack surface.

Technical ContextAI

V8 is Google Chrome's open-source, high-performance JavaScript and WebAssembly engine responsible for parsing and executing web content. CWE-121 (Stack-Based Buffer Overflow) identifies the root cause as a write operation that exceeds the bounds of a stack-allocated memory region within V8. In JIT-compiled engine contexts, such overflows can corrupt return addresses or frame pointers on the call stack, enabling an attacker to redirect execution to controlled data. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all versions prior to the fixed release 150.0.7871.182. Critically, the CVSS Scope metric is Unchanged (S:U), which is consistent with the CVE description stating execution is achieved 'inside a sandbox' - successful exploitation yields arbitrary code execution within the Chrome renderer sandbox, not at OS level, meaning a secondary sandbox escape vulnerability would be required for full system compromise.

RemediationAI

The primary remediation is to upgrade Google Chrome to version 150.0.7871.182 or later using Chrome's built-in update mechanism (Help > About Google Chrome) or via enterprise deployment tools such as Google Admin Console, Microsoft Intune, or SCCM. SUSE administrators should apply the updated Chromium package through zypper or the SUSE security update channel. If immediate patching is not feasible, restrict user access to untrusted external web content via network proxy or content filtering policies, and enforce browser isolation or remote browser isolation (RBI) solutions to contain renderer-process exploitation. Note that network-level controls do not eliminate the vulnerability - they reduce exposure. There is no configuration-level workaround that addresses the underlying stack overflow; patching to 150.0.7871.182 is the only confirmed fix.