What is the CVSS score of EUVD-2026-69735?

EUVD-2026-69735 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-69735?

Within 24 hours, audit your deployment to identify all Chrome installations and their current versions to quantify exposure. Within 7 days, deploy Chrome 152.0.7977.75 or later across all endpoints using your standard patch management process; enable automatic updates where policy permits to reduce manual intervention. Within 30 days, verify 100% compliance with the minimum version and document any systems requiring exception review for risk management purposes.

Google Chrome EUVD-2026-69735

Q: Which versions of Google Chrome are affected by EUVD-2026-69735?

Google Chrome versions before 152.0.7977.75 contain a use-of-uninitialized-resource vulnerability in the V8 JavaScript engine that enables remote code execution when users visit a crafted webpage.. A patch is available.

| CVE-2026-84326 HIGH

Use of Uninitialized Resource (CWE-908)

2026-09-02 chrome-cve-admin@google.com

GHSA-jxq7-x28c-j85p

RCE Google Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker crafts malicious HTML/JS page
Delivery

Victim visits page in vulnerable Chrome
Exploit

V8 processes uninitialized resource
Execution

Memory corruption primitive achieved
Impact

Arbitrary code executes inside Chrome sandbox

Vulnerability Assessment

Weakness	CWE CWE-908 ASVS 5.0 V15 - Secure Coding and Architecture Variable initialization
Exploitation Conditions	The victim must open a crafted HTML page in a vulnerable Google Chrome build (any version prior to 152.0.7977.75) on a desktop platform. No authentication, no special browser configuration, and no installed extensions are required - standard web browsing to the attacker-controlled page is sufficient to trigger the vulnerability. Exploitation is bounded to code execution within the Chrome renderer sandbox; escalation beyond the sandbox is not part of this CVE. The SSVC 'Automatable: no' classification reflects the required user interaction (UI:R), which prevents fully automated mass exploitation without a social-engineering or malvertising delivery layer.
Impact	The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects a network-delivered, unauthenticated, drive-by attack requiring only a single user page visit - a well-understood and realistic threat model for browser vulnerabilities. SSVC rates Technical Impact as 'total' (full compromise of in-scope process) but Exploitation as 'none' and Automatable as 'no,' the latter because UI:R prevents mass automated exploitation without user interaction. No CISA KEV listing and no public POC have been identified at time of analysis, which meaningfully reduces urgency relative to the raw CVSS score. EPSS data was not provided, leaving probabilistic exploitation likelihood unquantified. The sandbox confinement is a significant mitigating factor: this CVE alone does not grant OS-level access, and a chained sandbox escape would be required for full system compromise. Organizations relying on auto-update channels should confirm propagation; those managing Chrome Enterprise deployments via policy should treat this as a routine but prompt update cycle.
Exploit ScenarioDerived	An attacker publishes a malicious web page containing crafted JavaScript designed to trigger the V8 uninitialized resource condition. A user on a vulnerable Chrome version visits the page - whether via phishing link, malvertising, or a compromised legitimate site - causing arbitrary code execution within the Chrome renderer sandbox. No public POC has been identified at the time of analysis, and achieving full OS-level compromise would additionally require a separate sandbox escape primitive.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 02, 2026

Remote code execution within the browser sandbox is possible in Google Chrome versions prior to 152.0.7977.75 due to a use-of-uninitialized-resource flaw (CWE-908) in the V8 JavaScript engine. An attacker can trigger the vulnerability by luring a user to a crafted HTML page, with no authentication or special privileges required beyond normal web browsing. Google has released the patched build 152.0.7977.75; SSVC rates exploitation status as none and no CISA KEV listing has been identified at time of analysis.

RemediationAI

Update Google Chrome to version 152.0.7977.75 or later, as documented in the vendor's stable-channel advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html. Users with automatic updates enabled will receive this build without manual action; verify via chrome://settings/help. Chrome Enterprise administrators should deploy the update through their policy management tooling (Google Admin console or GPO) and confirm version compliance across managed endpoints. No documented workarounds exist for this specific V8 flaw - feature-level mitigations such as disabling JavaScript would broadly break site functionality and are not practical compensating controls. Until patching is confirmed, restricting access to untrusted or unvetted web content through proxy filtering or URL categorization policies reduces exposure.

Affected VersionsENISA

Chrome 152.0.7977.75 <152.0.7977.75

Affected Packages

euvd chrome fix: 152.0.7977.75

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

V8 is Google Chrome's high-performance open-source JavaScript and WebAssembly engine. CWE-908 (Use of Uninitialized Resource) describes a condition where allocated memory or a resource is accessed before being properly initialized, potentially exposing attacker-influenced data to program logic in ways that produce memory corruption or type-confusion primitives. In a browser JIT context, uninitialized state in V8 can be shaped by attacker-controlled JavaScript to redirect execution flow. The affected versions are confirmed via the EUVD entry as Chrome builds prior to 152.0.7977.75. Exploitation is confined to the renderer sandbox process; achieving OS-level impact would require a separate sandbox escape primitive not described in this CVE.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (google) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network-delivered drive-by via crafted page, no auth needed, user visit required (UI:R), scope unchanged (sandbox boundary holds), full in-sandbox C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE CRITICAL

Red Hat 8.8 HIGH

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 02, 2026 - 02:01 EUVD

CVE Published

Sep 02, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 02, 2026 - 00:18 cve.org

HIGH 8.8

DescriptionCVE.org

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive ViewAI

Why It Matters

Google Chrome versions before 152.0.7977.75 contain a use-of-uninitialized-resource vulnerability in the V8 JavaScript engine that enables remote code execution when users visit a crafted webpage. The attack requires no authentication-any user browsing the web is at risk-and affects organizations globally across all deployed Chrome instances. Immediate patching is critical to prevent potential compromise of user systems and data accessed through the browser.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Prevalence

Ubiquitous

dominant desktop browser across enterprise and consumer environments globally

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.