EUVD-2026-35232
GHSA-mj29-63w7-jwqf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious HTML page
-
DeliveryLure victim via phishing or malvertising
-
ExploitPage induces specific TabStrip UI gesture
-
ExecutionTrigger use-after-free in browser process
-
PersistExecute arbitrary code outside renderer sandbox
-
ImpactEstablish persistence or pivot to host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to load attacker-controlled HTML in a vulnerable Chrome (prior to 149.0.7827.103) AND to perform specific tab-related UI gestures that the page induces (the description explicitly says 'convinced a user to engage in specific UI gestures'). Limiting factors: required user interaction (UI:R in CVSS), high attack complexity (AC:H, likely indicating a timing or race window in TabStrip object lifecycle), and the user must be on a desktop Chrome build still running an unpatched version. No authentication is required to deliver the malicious page (PR:N), and the attack works against default Chrome configurations - Site Isolation and the renderer sandbox do not mitigate because TabStrip lives in the browser process. |
| Impact | Signals are mixed and lean toward elevated-but-not-emergency risk. CVSS 7.5 with AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H reflects high impact but tempered by high attack complexity (race or gesture timing) and required user interaction. Google's internal severity rating of Critical and the browser-process scope of TabStrip argue for prompt patching, but UI:R + AC:H meaningfully reduce drive-by mass-exploitation viability. No KEV listing and no public exploit identified at time of analysis suggest this is not yet operationalized. EPSS score was not provided in the input and should be checked separately. Treat as high priority for fleet patching but not as an emergency zero-day response. |
| Exploit ScenarioDerived | An attacker hosts a malicious HTML page (or compromises an ad-network creative) crafted to manipulate the TabStrip state, then lures a victim via phishing or watering-hole. When the user performs the required UI gesture - for example, dragging a tab, closing a tab, or interacting with a prompt the page induces - the use-after-free in TabStrip is triggered, yielding code execution in the browser process outside the renderer sandbox. No public exploit identified at time of analysis, but the browser-process scope makes this attractive for targeted intrusions if weaponized. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in Google Chrome versions prior to 149.0.7827.103 stems from a use-after-free flaw in the TabStrip UI component, allowing remote attackers to execute arbitrary code when victims interact with a malicious HTML page via specific UI gestures. Google rates the Chromium severity as Critical, and a vendor-released patch is available; no public exploit has been identified at time of analysis. The high attack complexity (AC:H) and required user interaction (UI:R) constrain mass exploitation despite the severe technical impact.
RemediationAI
Apply the vendor-released patch by upgrading Google Chrome to version 149.0.7827.103 or later on all desktop platforms; the fix is delivered through Chrome's Stable channel auto-update, but enterprise-managed fleets should force the update via Google Update / Chrome Browser Cloud Management and verify version compliance, as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Downstream Chromium-based browsers must be updated separately once their vendors ship a rebase. As a compensating control until patched, restrict browsing to trusted sites via web filtering, enable Site Isolation (default on), and consider deploying Enhanced Safe Browsing - note these reduce but do not eliminate exposure, since the bug is reachable from any attacker-controlled HTML page combined with a user gesture.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TabStrip is the Chromium UI component that manages browser tab rendering, lifecycle, and drag/reorder gestures within Chrome's browser process. The CWE-416 use-after-free root cause indicates that a TabStrip-owned object is freed while another code path retains a dangling pointer, likely triggered when a renderer-served HTML page induces a sequence of UI tab manipulations (drag, drop, close, reorder) that race against tab teardown. Because TabStrip runs in the privileged browser process rather than the sandboxed renderer, successful exploitation gives attackers code execution outside the renderer sandbox - a more serious posture than typical V8 or Blink memory bugs.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome versions before 149.0.7827.103 contain a remote code execution vulnerability in the TabStrip UI component that allows attackers to execute arbitrary code when users visit malicious websites and perform specific UI interactions. While the vulnerability is remotely exploitable, the requirement for user interaction and high technical complexity constrain the practical exploitation risk; a vendor patch is available and should be deployed immediately.
Apply vendor patch. Update to Google Chrome 149.0.7827.103 or later. Until patched, restrict use of untrusted websites and implement security awareness training to reduce likelihood of users visiting malicious sites.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB