What is the CVSS score of EUVD-2026-47576?

EUVD-2026-47576 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-47576?

Google Chrome versions prior to 150.0.7871.182 are vulnerable to remote code execution via malicious websites-currently no public exploit has been identified, but the risk remains critical.. A patch is available.

How to fix or mitigate EUVD-2026-47576?

Within 24 hours, inventory Chrome versions across organizational devices and notify endpoint management of urgent patch requirements for Chrome 150.0.7871.182 or later (vendor-released patch). Deploy this patch organization-wide within 7 days using automated update mechanisms or manual distribution as appropriate. By day 30, verify deployment completion through endpoint telemetry and establish ongoing monitoring for failed updates or version rollbacks.

Google Chrome EUVD-2026-47576

| CVE-2026-16423 HIGH

Use After Free (CWE-416)

2026-07-21 chrome-cve-admin@google.com

GHSA-xj4j-jpm9-437j

Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N), no auth (PR:N), but the required specific UI gestures make it UI:R; a UAF yielding renderer code execution justifies C/I/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 14:23 vuln.today

CVSS changed

Jul 22, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

Jul 21, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 21, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in the Google Chrome UI component (fixed in 150.0.7871.182) allows a remote attacker to induce heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to arbitrary code execution in the renderer. Rated High by Chromium and CVSS 8.8; no public exploit identified at time of analysis, though the vendor patch is available. Exploitation is gated on user interaction, reducing drive-by risk relative to zero-click browser bugs.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's UI subsystem, meaning code retains and dereferences a pointer to a heap object after it has been freed, allowing an attacker to groom the heap and reclaim the freed allocation with attacker-controlled data. Because it resides in the browser UI layer rather than a sandboxed sub-component like V8 or a GPU process, the specific 'UI gesture' trigger implies the bug is reached through user-driven interface events (e.g., menu, dialog, or drag interactions) rather than pure page rendering. Chrome is built on the Chromium engine (Blink/V8), and memory-safety defects of this class are the dominant browser vulnerability category; successful exploitation typically corrupts C++ object vtables or callback pointers to hijack control flow.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.182 - update to this version or later via Chrome's built-in updater (chrome://settings/help) and relaunch to apply, as documented in the Stable Channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0256605430.html. In managed environments, push the update through enterprise policy/MSI and force a browser restart, since Chrome only completes patching on relaunch. Until updates propagate, reduce exposure by training users not to perform prompted UI gestures on untrusted pages and by using enterprise policies to limit browsing to trusted sites; note that no configuration-level mitigation fully removes the risk, so patching is the only reliable fix. Users of Chromium-based browsers should apply their respective vendor updates once the upstream fix is merged.