EUVD-2026-35249
GHSA-2hgr-cprg-9825
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker stages crafted HTML on attacker-controlled site
-
DeliveryLures victim via phishing or malvertising
-
ExploitVictim's Chrome loads page and executes JavaScript
-
ExecutionV8 use-after-free triggered in renderer
-
PersistAttacker gains arbitrary code execution in sandbox
-
ImpactOptional chain with sandbox escape for host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must open or be redirected to an attacker-controlled HTML page in a vulnerable Chrome build (<149.0.7827.103) with JavaScript enabled - the default configuration. No authentication, credentials, or prior access to the target system is required (PR:N). Exploitation requires user interaction (UI:R) in the form of visiting the malicious page, which limits opportunistic mass exploitation but is trivial via phishing, malvertising, or compromised sites. Limiting factors: code execution is confined to the renderer's V8 sandbox (S:U) so a separate sandbox-escape vulnerability is needed for host-level compromise; enterprise deployments with strict URL allowlisting, browser isolation, or aggressive auto-update policies materially reduce exposure. |
| Impact | Signals are mixed but lean toward prioritized patching. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) reflects network-reachable, low-complexity, unauthenticated exploitation that requires only a single user click on a malicious page - a realistic phishing or watering-hole scenario. Tags explicitly call out RCE and memory corruption, and Chromium internally rated this High severity. Counterweights: EPSS score not provided in the input, the CVE is not currently on CISA KEV, no public POC is referenced, and scope is Unchanged (S:U) meaning impact is bounded to the sandboxed renderer absent a chained escape. Historically, V8 use-after-frees are among the most frequently exploited Chrome bug classes once technical details surface from the Chromium issue tracker, so the window between patch and weaponization is typically short. Treat as high priority for endpoints despite no current KEV listing. |
| Exploit ScenarioDerived | An attacker hosts or compromises a website containing a crafted HTML/JavaScript payload that triggers the use-after-free in V8's object lifetime handling. A victim browsing with a vulnerable Chrome build is sent to the page via phishing email, malvertising, or watering-hole compromise (UI:R - single click required), at which point JavaScript reclaims the freed memory and pivots to arbitrary code execution inside the renderer sandbox. No public exploit identified at time of analysis, but the attacker would typically chain this with a sandbox-escape bug to achieve full host compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.103 allows attackers to execute arbitrary code within the renderer sandbox by luring a user to a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High severity by Chromium, with a CVSS 8.8 score reflecting low attack complexity but requiring user interaction. No public exploit identified at time of analysis, though V8 use-after-frees historically attract rapid weaponization for browser exploit chains.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 or later on the Stable channel - update via Chrome's built-in updater (chrome://settings/help) or via managed deployment tools (Chrome Browser Cloud Management, Intune, JAMF, WSUS). Confirm Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) have absorbed the equivalent V8 fix before declaring fleets remediated. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and the Chromium issue at https://issues.chromium.org/issues/511270083. If patching is delayed, compensating controls include disabling the V8 optimizer via the --js-flags='--no-opt' command-line switch (degrades JavaScript performance significantly on modern web apps), enforcing Site Isolation (chrome://flags/#enable-site-per-process) which is on by default but worth verifying, restricting browsing to allowlisted sites via enterprise policy (URLAllowlist/URLBlocklist), and using EDR/browser-isolation tooling to neutralize untrusted HTML payloads - note that --no-opt breaks some web apps and URL allowlisting impacts user productivity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is Google's open-source high-performance JavaScript and WebAssembly engine that powers Chrome, Chromium-based browsers (Edge, Opera, Brave), and Node.js. The root cause is CWE-416 (Use After Free), where memory is referenced after being freed - typically due to incorrect lifetime management in V8's optimizing compilers (TurboFan, Maglev) or garbage collector (Orinoco). When a freed object is reused with attacker-controlled data, the dangling pointer enables arbitrary read/write primitives that can be escalated to code execution within the V8 isolate. Code execution remains constrained to Chrome's renderer sandbox; full system compromise requires a separate sandbox escape.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome vulnerabilities affecting employee computers pose a direct risk to sensitive corporate data and system integrity. This flaw allows malicious websites to execute code within the browser sandbox when users visit them. Immediate patching to Chrome 149.0.7827.103 or later is critical to prevent system compromise and potential data theft across the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB