EUVD-2026-35249
GHSA-2hgr-cprg-9825
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.103 allows attackers to execute arbitrary code within the renderer sandbox by luring a user to a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High severity by Chromium, with a CVSS 8.8 score reflecting low attack complexity but requiring user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Victim must open or be redirected to an attacker-controlled HTML page in a vulnerable Chrome build (<149.0.7827.103) with JavaScript enabled - the default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but lean toward prioritized patching. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts or compromises a website containing a crafted HTML/JavaScript payload that triggers the use-after-free in V8's object lifetime handling. A victim browsing with a vulnerable Chrome build is sent to the page via phishing email, malvertising, or watering-hole compromise (UI:R - single click required), at which point JavaScript reclaims the freed memory and pivots to arbitrary code execution inside the renderer sandbox. … |
| Remediation | Vendor-released patch: Google Chrome 149.0.7827.103 or later on the Stable channel - update via Chrome's built-in updater (chrome://settings/help) or via managed deployment tools (Chrome Browser Cloud Management, Intune, JAMF, WSUS). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Initiate communication to all Chrome users and enable automatic Chrome updates if not already configured. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today