What is the CVSS score of EUVD-2026-69730?

EUVD-2026-69730 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-69730?

Google Chrome (desktop) contains a critical sandbox escape vulnerability enabling remote code execution when users open a crafted webpage, affecting millions of corporate and consumer users globally.. A patch is available.

How to fix or mitigate EUVD-2026-69730?

Within 24 hours: Issue urgent security bulletin to all Chrome users and deploy or make available version 152.0.7977.75 or later; if Chrome is managed centrally (via MDM/GPO), immediately trigger forced updates across all endpoints. Within 7 days: Verify patch deployment across at least 95% of managed Chrome instances and publish remediation checklist for personal/unmanaged devices; monitor vendor advisories and security feeds for exploitation indicators. Within 30 days: Complete organization-wide audit confirming all Chrome instances are patched to 152.0.7977.75 or later, review access logs and browser telemetry for suspicious activity, and document patch completion for compliance reporting.

Google Chrome EUVD-2026-69730

| CVE-2026-84354 CRITICAL

Incorrect Authorization (CWE-863)

2026-09-02 chrome-cve-admin@google.com

GHSA-77ww-pg49-9w44

RCE Google Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page (AV:N/AC:L/PR:N) requires the victim to open it (UI:R); sandbox escape crosses a privilege boundary (S:C) yielding full code execution (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 02, 2026 - 10:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 02, 2026 - 10:29 vuln.today

CVSS changed

Sep 02, 2026 - 10:22 NVD

9.6 (CRITICAL)

Patch available

Sep 02, 2026 - 02:01 EUVD

CVE Published

Sep 02, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 02, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape and out-of-sandbox arbitrary code execution in Google Chrome (desktop) before 152.0.7977.75, rooted in an incorrect authorization flaw in the FileSystem component. A remote attacker who lures a victim into opening a crafted HTML page can break out of the renderer sandbox and run code with the privileges of the browser process. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the victim to open a crafted HTML page in a vulnerable Chrome desktop build (< 152.0.7977.75) - the CVSS UI:R and the description's explicit 'leveraging social engineering' confirm user interaction (navigating to attacker content) is mandatory, which is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority patch, not a paper tiger: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes an unauthenticated, low-complexity, network-delivered sandbox escape with full C/I/A impact, gated only by a single user action (visiting a page). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: update Google Chrome to 152.0.7977.75 or later on the stable channel (per the Chrome Releases advisory, https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Issue urgent security bulletin to all Chrome users and deploy or make available version 152.0.7977.75 or later; if Chrome is managed centrally (via MDM/GPO), immediately trigger forced updates across all endpoints. …

Threat intelligence, references, and detailed analysis are available after sign-in.