EUVD-2026-35230
GHSA-72h3-r85p-88m3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker hosts crafted HTML page
-
DeliveryLure victim via phishing or malvertising
-
ExploitVictim opens page in vulnerable Chrome
-
InstallPage triggers File Input use-after-free
-
C2Heap corruption in renderer process
-
ExecuteChain with sandbox escape for code execution
-
ImpactEstablish foothold on user endpoint
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must browse to attacker-controlled or attacker-influenced HTML using a Chrome desktop build older than 149.0.7827.103, and must reach a code path that exercises the File Input component (a page that scripts or renders an <input type="file"> element in the vulnerable manner). Required user interaction (UI:R) is the principal limiting factor - exploitation cannot occur without the user loading the malicious page - and no authentication to Chrome or the target site is required (PR:N). Mobile Chrome and other Chromium derivatives are affected only insofar as they share the unpatched code; managed environments that enforce strict URL allowlists or disable file-picker UI substantially reduce reachability. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity, unauthenticated bug whose only meaningful barrier is required user interaction (visiting a malicious page), yielding a base score of 8.8. Chromium's internal Critical severity rating is more aggressive than the CVSS High and suggests a memory-corruption primitive with strong exploitability potential. No EPSS score, KEV listing, or public POC was supplied, so there is no evidence of active exploitation at this time; however, browser use-after-frees in default-enabled components historically attract exploit development quickly, and absence of KEV data should not be read as confirmation that exploitation is not occurring. Treat this as a real priority for any Chrome-based desktop deployment despite the limited corroborating telemetry. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that scripts the file-input element to trigger the use-after-free, then delivers it via phishing, malvertising, or a watering-hole compromise. When a victim visits the page in a vulnerable Chrome build, the heap corruption is triggered inside the renderer process, giving the attacker a memory-corruption primitive that can be developed into code execution within the sandbox - and, if chained with a sandbox-escape bug, into full system compromise. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Heap corruption in Google Chrome's File Input component before version 149.0.7827.103 allows a remote attacker to exploit a use-after-free condition by luring a user to a crafted HTML page, with Chromium rating the issue Critical. No public exploit identified at time of analysis, but the high CVSS 8.8 score and browser attack surface make this a priority patch for desktop fleets.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 (Stable channel) - upgrade all desktop installations immediately via the built-in updater or managed deployment tooling, then force a browser restart so the new binaries are loaded. Validate the rollout against the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and verify downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) have absorbed the fix before considering remediation complete. As a compensating control until patching completes, restrict browsing to trusted sites via enterprise URL allowlists or proxy filtering, and consider temporarily disabling file upload workflows on untrusted origins through site-permission policies - note the trade-off that this breaks legitimate file-upload features on web apps. Avoid relying on the site-isolation sandbox alone, since a UAF in the renderer can be chained with a separate sandbox escape.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's File Input handling, the rendering-engine component responsible for processing <input type="file"> elements and associated file-picker interactions. Classified as CWE-416 (Use After Free), the root cause is a dangling pointer to a heap object that has already been freed; subsequent dereferences let an attacker manipulate the freed allocation to corrupt heap metadata or hijack control flow. In Chromium's sandboxed renderer process, such bugs are commonly chained with a sandbox escape to achieve full code execution outside the browser, but on their own they can still leak data or crash the process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome versions prior to 149.0.7827.103 contain a HIGH-severity heap corruption vulnerability in the File Input component that can be exploited when users visit a malicious webpage; no public exploit identified at time of analysis. This issue exposes the entire desktop user base to potential compromise given Chrome's ubiquity in enterprise environments. Immediate patch deployment across all systems is required to eliminate this significant organizational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB