EUVD-2026-35238
GHSA-4h64-69gw-4pgg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconLure victim to malicious site
-
DeliveryServe crafted HTML and JS
-
ExploitTrigger UAF in Printing component
-
InstallGroom heap and reclaim freed object
-
C2Hijack control flow in renderer
-
ExecuteEscape sandbox into browser process
-
ImpactExecute code with browser privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must load an attacker-controlled HTML page in a vulnerable Chrome build (<149.0.7827.103) and the page must exercise the Printing code path - consistent with the CVSS UI:R flag, some user interaction is required, which in past Chrome Printing UAFs has ranged from merely loading the page (if the JS can auto-trigger print preview or the affected API) to explicitly invoking print. No authentication is required (PR:N) and no special server-side or victim-side configuration is needed beyond default Chrome desktop installs. Exploitation is limited by Chrome's auto-update mechanism (patched users are out of scope quickly), by Site Isolation which still constrains cross-origin data access during the renderer phase, and by the fact that turning a UAF into a reliable sandbox escape generally requires being chained with an additional renderer-side memory corruption primitive. |
| Impact | Risk is high in practical terms: CVSS 9.6 with AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H reflects a remote, low-complexity, unauthenticated attack that only needs a user to visit a page, and the scope change captures the sandbox escape itself - one of the most impactful outcomes in a browser. EPSS data was not provided, and CISA KEV status is not indicated in the input, so this is currently no public exploit identified at time of analysis despite Chromium's internal Critical rating. The Chromium Critical severity label combined with sandbox-escape impact means defenders should treat this as a high-priority patch even absent confirmed in-the-wild use, because Chrome UAF bugs in Printing have a strong track record of being chained with renderer RCE bugs in real attacks. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or buys an ad slot serving one) that contains JavaScript and HTML crafted to trigger the use-after-free in Chrome's Printing component when the page is rendered or when the user is induced to invoke print-related functionality. The freed object is reclaimed with attacker-controlled data, leading to control-flow hijack in the renderer and a pivot across the sandbox boundary into the browser process - typically chained with a renderer RCE bug. No public exploit identified at time of analysis, but Chromium-rated Critical Printing UAFs have historically been turned into working exploits within days of disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Sandbox escape in Google Chrome versions prior to 149.0.7827.103 enables remote attackers to break out of the browser's renderer sandbox via a crafted HTML page that triggers a use-after-free in the Printing component. Chromium rated this issue Critical severity, and the CVSS scope change (S:C) confirms the sandbox boundary is crossed; no public exploit identified at time of analysis, but the attack only requires the victim to load attacker-controlled content.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.103 or later on all desktop platforms; this is the vendor-released patch referenced in the Stable Channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, with tracking details at https://issues.chromium.org/issues/517047197. Force-relaunch managed browsers via enterprise policy to ensure the update applies, and verify build numbers post-deployment. As compensating controls until patching completes, administrators can disable the in-browser print preview / printing feature through enterprise policy (PrintingEnabled=false), which removes the vulnerable code path at the cost of breaking legitimate web-initiated printing, and can restrict browsing to trusted sites via SafeSites or URL allowlists to reduce exposure to crafted HTML, accepting the productivity impact of constrained browsing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chromium's Printing subsystem, which handles print preview rendering, PDF generation, and the print dialog flow across renderer and browser processes. CWE-416 (Use After Free) indicates that an object is referenced after its memory has been freed, typically producing a dangling pointer that an attacker can groom to control freed memory contents. In Chromium, such Printing-component UAFs have historically been weaponized to corrupt IPC handlers or privileged browser-process objects, which is consistent with the scope-changed (S:C) CVSS vector here that signals impact beyond the originally compromised component - in this case, escape from the renderer sandbox.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Articles & Coverage 1
Executive ViewAI
Google Chrome versions prior to 149.0.7827.103 contain a critical sandbox escape vulnerability (CVSS 9.6) that allows remote attackers to execute arbitrary code on users' systems through a crafted webpage. Any user accessing attacker-controlled content becomes compromised, with potential for data theft, credential harvesting, or lateral movement into the organization's network.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB