EUVD-2026-34711
GHSA-62v9-gfp5-v299
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via prior exploit
-
DeliveryLure victim to crafted HTML page
-
ExploitTrigger use-after-free in DevTools
-
ExecutionRead freed memory contents
-
PersistExfiltrate sensitive process data
-
ImpactChain into sandbox escape
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have already compromised the renderer process - this is a chained, second-stage capability rather than a standalone bug, and is explicitly stated in the CVE description. The attacker must then deliver a crafted HTML page that the compromised renderer processes, and the CVSS vector specifies UI:R, indicating the victim must perform some user interaction (such as visiting the attacker-controlled page or invoking DevTools-related functionality). The bug is limited to Chrome desktop Stable builds prior to 149.0.7827.53; environments where Chrome auto-updates are enforced or where DeveloperToolsAvailability is set to DeveloperToolsDisallowed via enterprise policy materially reduce realistic exposure. |
| Impact | The signals here conflict and must be weighed carefully: NVD assigns CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) implying critical impact, yet Google's own Chromium severity rating is Low and the described impact is limited to information disclosure from process memory - not the full C:H/I:H/A:H the vector suggests. The CVSS PR:N rating is also misleading because the description explicitly requires the attacker to have already compromised the renderer process, meaning a prior exploit (typically another Chrome bug) is a hard prerequisite - this is a second-stage capability, not a single-shot RCE. There is no CISA KEV listing, no EPSS score provided, and no public POC identified, so realistic priority is moderate: patch in normal cycles rather than emergency response, but do not dismiss because the cross-process leak is useful in exploit chains. EPSS data is missing from the input and should be checked independently before final prioritization. |
| Exploit ScenarioDerived | An attacker first lands a separate renderer-compromise exploit (for example, a V8 type confusion) via a malicious or compromised website, then serves a crafted HTML page that drives the now-controlled renderer to interact with DevTools internals and trigger the use-after-free. The freed-then-reused memory is read back to the attacker, leaking pointers, tokens, cookies, or other secrets from the browser process to enable sandbox escape or further lateral movement. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Information disclosure in Google Chrome DevTools prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. The flaw stems from a use-after-free condition (CWE-416) in DevTools, and while Google rates the underlying Chromium severity as Low, the NVD CVSS of 9.6 reflects the cross-origin scope change possible when chained with a prior renderer compromise. No public exploit identified at time of analysis.
RemediationAI
Upgrade Google Chrome to the Stable channel build 149.0.7827.53 or later, as released in the June 2026 Stable Channel Update for Desktop (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html); Chrome's auto-update mechanism will deliver this on browser restart, so enterprises should enforce a restart policy rather than rely on user action. Confirm the deployed build via chrome://settings/help across managed fleets and update embedded Chromium-based applications (Electron, CEF, browser shells) once their upstream rolls in the same patch. No specific workaround is published; as a compensating control until the patch is deployed, disabling the renderer-exposed DevTools surface via the DeveloperToolsAvailability enterprise policy set to DeveloperToolsDisallowed reduces the attack surface but at the cost of breaking developer and support workflows that rely on DevTools.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's DevTools subsystem, the in-browser debugging and inspection tooling exposed to web content through internal IPC channels. CWE-416 (Use After Free) indicates the code path frees a memory object but later dereferences a dangling pointer, allowing attacker-controlled or stale memory contents to be read or repurposed. Because DevTools operates with elevated privileges relative to ordinary renderer content, a UAF reachable from a compromised renderer can leak data across Chrome's sandbox or process boundaries, which is reflected in the CVSS Scope:Changed designation. The affected CPE per EUVD is Chrome builds below 149.0.7827.53 across the Stable desktop channel.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome DevTools prior to version 149.0.7827.53 contains a critical information disclosure vulnerability (CVSS 9.6) that could allow attackers to extract sensitive data from process memory following renderer compromise. No public exploit has been identified at time of analysis; however, the vulnerability affects all Chrome users and organizations should prioritize immediate patching to prevent potential data exfiltration in targeted attack scenarios.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB