What is the CVSS score of EUVD-2026-48443?

EUVD-2026-48443 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-48443?

Google Chrome versions prior to 150.0.7871.186 contain a use-after-free vulnerability in the Input component that allows attackers who have compromised the renderer process to escape the sandbox and…. A patch is available.

How to fix or mitigate EUVD-2026-48443?

Within 24 hours, identify all systems running Chrome versions prior to 150.0.7871.186 using device inventory tools and begin patch distribution planning. Within 7 days, deploy Chrome 150.0.7871.186 or later to all endpoints through your standard patch management process, prioritizing critical systems. Within 30 days, verify 100% patch compliance across the organization and confirm all Chrome instances are at version 150.0.7871.186 or later.

Google Chrome EUVD-2026-48443

| CVE-2026-16804 HIGH

Use After Free (CWE-416)

2026-07-23 Chrome

GHSA-3hcw-xj48-v732

Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H reflects mandatory pre-compromised renderer prerequisite; S:C captures sandbox boundary crossing; full C/I/A post-escape justified.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 08:40 vuln.today

tag: Denial Of Service removed

Analysis Generated

Jul 26, 2026 - 11:57 vuln.today

CVSS changed

Jul 24, 2026 - 13:22 NVD

8.3 (HIGH)

CVE Published

Jul 23, 2026 - 21:36 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 23, 2026 - 21:36 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in Chrome's Input component enables an attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. Affected versions span all Google Chrome releases prior to 150.0.7871.186 across Windows, macOS, and Linux. Successful exploitation grants code execution outside the sandbox with the full privileges of the browser process on the underlying host. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS stands at 0.25% (16th percentile), consistent with no observed in-the-wild activity.

Technical ContextAI

The vulnerability is a Use-After-Free (CWE-416) in Chrome's Input handling subsystem, which manages input event dispatch within Blink's multi-process rendering architecture. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all affected builds. Chrome's security model isolates renderer processes in a sandbox; this UAF allows a renderer-level attacker to corrupt memory in a way that crosses the sandbox boundary (reflected by S:C in the CVSS vector). Downstream Linux distributions, specifically Red Hat and SUSE variants that package Chromium, may carry the same vulnerable codebase until their respective advisory-tracked updates are shipped.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.186 or later, which constitutes the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01320465736.html. Chrome auto-updates by default, but administrators should verify installed versions via Settings > Help > About Google Chrome and force an update cycle in managed environments. Red Hat and SUSE deployments should monitor vendor security advisories for corresponding Chromium package updates. Until patching is complete, enterprise controls that limit browsing to known-safe domains (e.g., managed browser policies, DNS filtering, or proxy allowlisting) reduce the likelihood of the renderer-level compromise that is the prerequisite for this vulnerability, though they do not constitute a substitute for patching.