EUVD-2026-35229
GHSA-c729-j7cm-x9p7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim browses to attacker-controlled URL
-
DeliveryMalicious HTML/JS loaded in renderer
-
ExploitJavaScript grooms heap and triggers Ozone UAF
-
ExecutionFreed object reused with attacker data
-
PersistHijack control flow in renderer process
-
ImpactChain with sandbox escape for host RCE
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must use Google Chrome at a version below 149.0.7827.103 and must be induced to load attacker-controlled HTML in the browser (UI:R - user interaction required, satisfied by clicking a link, viewing a malicious ad, or being redirected). No authentication to Chrome or any service is required (PR:N), and no non-default browser configuration is needed - the vulnerable Ozone code path ships in stock Chrome on all supported desktop platforms (Windows, macOS, Linux, ChromeOS). Exploitation is limited to renderer-process compromise (S:U, sandbox boundary intact), so full host takeover additionally requires chaining a separate sandbox-escape vulnerability, and enterprise deployments with Site Isolation and Enhanced Safe Browsing raise the bar further. |
| Impact | The CVSS 8.8 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a realistic browser-bug profile: network-reachable, low complexity, no authentication, but requires the user to visit a crafted page, and the impact stays inside the renderer sandbox (S:U). Chromium's internal Critical severity rating elevates priority above the CVSS number alone, because Google reserves that label for issues believed to permit sandboxed code execution likely to chain with a sandbox escape. No EPSS score, KEV listing, or public POC was provided in the input, so there is no current evidence of in-the-wild exploitation - however, Ozone UAFs have historically been targeted by exploit chains, and the gap between Stable channel disclosure and weaponization for Chrome bugs is typically short. Treat as high priority for any endpoint fleet running Chrome despite the absence of KEV/EPSS signals. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page (or injects it via a compromised ad network or watering-hole site) that uses JavaScript and DOM manipulation to drive Ozone into the vulnerable code path, freeing an object whose dangling pointer is later dereferenced. When a victim running pre-149.0.7827.103 Chrome loads the page, the attacker grooms the heap to place controlled data at the reused allocation, achieving renderer-process code execution that would typically be paired with a separate sandbox-escape bug to compromise the host. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Heap corruption in Google Chrome's Ozone display server component prior to version 149.0.7827.103 allows remote attackers to exploit a use-after-free condition through a malicious web page, with Chromium rating this as Critical severity. Successful exploitation requires the victim to visit attacker-controlled HTML content, but yields high impact on confidentiality, integrity, and availability in the renderer process. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
RemediationAI
Vendor-released patch: update Google Chrome to 149.0.7827.103 or later on all desktop platforms, as published in the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html); the Chromium tracker entry is https://issues.chromium.org/issues/516674532. Force the update by restarting Chrome on managed endpoints and verify via chrome://settings/help, and apply equivalent updates to downstream Chromium browsers (Edge, Brave, Opera, Electron apps) as those vendors ship respins. As a temporary compensating control until patching completes, enable Enhanced Safe Browsing and consider enforcing Site Isolation via enterprise policy and blocking unknown-origin sites at the proxy - disabling JavaScript via policy would mitigate but breaks the modern web and is generally not viable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ozone is Chromium's platform abstraction layer that handles window-system integration, graphics buffer management, and input event routing across Linux, ChromeOS, and other platforms - it sits between Chrome's compositor and the underlying display server (X11, Wayland, DRM). CWE-416 (Use After Free) indicates the renderer or GPU process retains and dereferences a pointer to a heap object after it has been freed, typically when object lifetime is not correctly tracked across asynchronous graphics or input callbacks. Attacker-controlled HTML/JavaScript can shape the heap and trigger the dangling reference, allowing reuse of the freed allocation with attacker data and subsequent control-flow hijack within the sandboxed renderer.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome versions prior to 149.0.7827.103 contain a critical heap corruption vulnerability in the Ozone display server that allows remote attackers to compromise systems when users visit malicious websites, threatening data confidentiality, integrity, and service availability. This affects all Chrome users across the organization and requires no user authentication to exploit. Immediate patching is essential to prevent data theft and system compromise.
Apply vendor patch to Chrome 149.0.7827.103 or later. If immediate deployment is constrained: (1) Restrict Chrome usage to business-essential tasks only; (2) Implement web filtering to block untrusted or unknown websites; (3) Deploy endpoint detection and response (EDR) solutions to identify exploitation attempts; (4) Isolate affected systems from sensitive data and credentials until patching is complete.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB