EUVD-2026-35264
GHSA-c668-r5mr-qr6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryVictim navigates to malicious URL
-
ExploitPage invokes Payment Request API
-
ExecutionTrigger use-after-free in Payments
-
PersistHeap corruption and control of freed object
-
ImpactArbitrary code execution in renderer process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must visit an attacker-controlled or attacker-injected HTML page using Chrome before version 149.0.7827.103 - user interaction (UI:R) is required, meaning no exploitation occurs without the user navigating to the page. The vulnerable code path is in the Payments component, so the crafted page must invoke Payment Request API functionality to reach the bug; payment features are enabled by default in stock Chrome, so no non-default configuration is needed. Limiting factors: scope is Unchanged so a separate sandbox escape is needed for code execution outside the renderer process, and enterprise policies that disable the Payment Request API would block the attack surface. |
| Impact | CVSS 8.8 with AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H positions this as a high-severity client-side bug: network-reachable, low complexity, no privileges required, but UI:R means a user must visit a malicious page. EPSS data was not provided in the input, so probability of near-term exploitation cannot be quantified here. The vulnerability is NOT in CISA KEV and no public PoC is referenced, so this is not confirmed actively exploited - however, Chromium use-after-free bugs in attacker-reachable components like Payments are historically attractive targets and have been chained into in-the-wild zero-day exploit chains in past Chrome releases. Scope is Unchanged (S:U), meaning impact is contained to the renderer process; full system compromise would require an additional sandbox escape. Treat this as a priority browser patch for end-user fleets even absent confirmed exploitation. |
| Exploit ScenarioDerived | An attacker hosts a malicious HTML page (or compromises an ad network / legitimate site) that, when loaded by a victim using a vulnerable Chrome version, invokes specific Payment Request API sequences to trigger the use-after-free, manipulate the heap, and gain code execution in the renderer process. A typical follow-on step would chain a separate sandbox escape to break out of the renderer for full host compromise. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Heap corruption in Google Chrome's Payments component before 149.0.7827.103 allows remote attackers to exploit a use-after-free condition by enticing a victim to visit a crafted HTML page, potentially achieving arbitrary code execution within the renderer sandbox. Chromium rates the severity as High, and CVSS 8.8 reflects network-reachable exploitation with low complexity, though successful exploitation requires user interaction (visiting an attacker-controlled page). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 (Stable channel desktop update). Update Chrome immediately via the built-in updater (chrome://settings/help) or push the new build through enterprise management (Chrome Browser Cloud Management, Group Policy, Jamf, Intune); see the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and the upstream tracker at https://issues.chromium.org/issues/513830374. For Chromium-based downstream browsers, install the corresponding rebased release once published by each vendor. As a temporary compensating control while updates roll out, consider disabling the Payment Request API via enterprise policy (PaymentMethodPrivacyEnabled / blocking payment handlers) to remove the vulnerable code path - note this will break legitimate one-click checkout flows on e-commerce sites. Web filtering to block untrusted sites reduces exposure to crafted HTML payloads but does not eliminate risk from compromised legitimate sites or ad networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the Payments subsystem of Chromium, the open-source browser engine underlying Google Chrome and many derivative browsers (Edge, Brave, Opera, Vivaldi). CWE-416 (Use After Free) occurs when memory is referenced after it has been freed, typically because object lifetime is mismanaged across asynchronous operations or event handlers - a common pattern in Chromium's multi-process renderer/IPC architecture. In the Payments component, this likely involves dangling pointers to PaymentRequest or related JavaScript-exposed objects whose backing C++ state is released while still reachable, enabling heap layout manipulation and corruption of adjacent allocations. Affected CPE corresponds to Chrome versions prior to 149.0.7827.103 on desktop platforms (Windows, macOS, Linux).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome contains a code execution vulnerability (CVSS 8.8) that could be triggered when users visit compromised or malicious websites. Organizations with significant Chrome deployments face potential data loss and system compromise-requiring immediate patching to mitigate this material risk to business operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB