EUVD-2026-35250
GHSA-35m9-r2q7-2ggv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts malicious HTML page
-
DeliveryLure victim via phishing or malvertising
-
ExploitVictim's Chrome loads attacker JavaScript
-
ExecutionTrigger use-after-free in V8
-
PersistGain code execution in renderer sandbox
-
ImpactExfiltrate data or chain sandbox escape
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must run a vulnerable Chrome desktop build (any version below 149.0.7827.103 on the stable channel) and must actively load attacker-controlled HTML/JavaScript in the browser (UI:R - clicking a link, visiting a malicious site, loading a malicious ad, or rendering an attacker-supplied iframe). No authentication to the target is required (PR:N), no special Chrome flags or non-default configuration are needed, and the vulnerability is reachable from any origin since V8 executes all web JavaScript. Exploitation is LIMITED by: (1) Chrome's renderer sandbox, which contains the initial code execution and requires a separate sandbox-escape bug for full host RCE; (2) Site Isolation, which scopes the compromise to one origin's process; (3) the auto-update mechanism, which patches most consumer installs within 24-72 hours of the advisory; and (4) the UI:R requirement, which rules out fully unattended exploitation. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated attack that requires a single user interaction (visiting a page) and full CIA impact on the renderer process, which is realistic for a browser drive-by. The description explicitly states code execution occurs 'inside a sandbox,' meaning the impact scope is bounded to the renderer unless chained with a sandbox escape - a critical mitigating factor when prioritizing against unsandboxed RCE. EPSS data was not provided in the input, and the bug is not listed in CISA KEV at time of analysis, so there is no confirmed widespread exploitation; however, Chrome stable-channel V8 fixes are frequently reverse-engineered within days of release, and the High Chromium severity plus 'RCE' tag warrants treating this as a priority browser patch rather than a low-real-risk issue. |
| Exploit ScenarioDerived | An attacker hosts or compromises a website serving a malicious HTML/JavaScript payload that triggers the V8 use-after-free, then lures a victim via phishing, malvertising, or a watering-hole compromise to visit the page in a vulnerable Chrome build. Once the UAF fires inside V8, the attacker gains arbitrary code execution in the renderer sandbox, typically used for credential theft from same-origin tabs, in-memory keystroke capture, or as the first stage of a chained sandbox escape to achieve full host compromise. No public exploit identified at time of analysis, but historical V8 UAF bugs have been reproduced from public patch diffs within days. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.103 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High severity by Chromium and carries a CVSS 8.8 score; no public exploit identified at time of analysis, but V8 UAF bugs are historically high-value targets for exploit chains.
RemediationAI
Vendor-released patch: update Google Chrome to 149.0.7827.103 or later via the stable channel auto-updater, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, and restart the browser to ensure the new V8 binary is loaded. In enterprise environments, push the update through the Chrome Enterprise MSI/PKG bundles or your endpoint management tool and verify chrome://settings/help shows the fixed build. Until rollout completes, viable compensating controls include enforcing Chrome's Site Isolation (already on by default - confirm it is not disabled by policy), enabling the V8 sandbox / V8 memory cage where supported, deploying script-blocking or strict CSP at the proxy for high-risk users, and routing high-value users through a remote browser isolation service; note these reduce attack surface but break some web features (Site Isolation increases memory use; script blocking breaks many SPAs; RBI adds latency and cost).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is the open-source JavaScript and WebAssembly engine that powers Chrome, Edge, and other Chromium-derived browsers. The root cause is CWE-416 (Use After Free), where memory referenced by a pointer is freed but the pointer remains accessible, allowing later operations to read or write into reallocated memory. In V8, such bugs typically arise from incorrect lifetime tracking in the JIT compiler (TurboFan/Maglev), garbage collector interactions, or object handle management, and they are commonly turned into type confusion primitives that lead to arbitrary read/write inside the renderer process. Per the CPE-equivalent data from EUVD, exploitation is confined to Chrome builds below 149.0.7827.103 across the desktop stable channel.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome contains a remote code execution vulnerability in its V8 JavaScript engine (CVSS 8.8) that allows attackers to compromise user systems through a malicious webpage. Although no public exploit has been identified at this time, the widespread use of Chrome and the severity of RCE require immediate patching across all organizational systems. Users should update to version 149.0.7827.103 or later without delay.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB