EUVD-2026-35271
GHSA-93cq-cwfp-9r89
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
AnalysisAI
Sandbox escape in Google Chrome before 149.0.7827.103 allows a remote attacker to break out of the renderer sandbox through a use-after-free in the Navigation component when a victim visits a crafted HTML page. The CVSS 9.6 score reflects a scope-changing impact on confidentiality, integrity, and availability with only user interaction (visiting a page) required, and no public exploit was identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must use a vulnerable Google Chrome desktop build prior to 149.0.7827.103 and must visit or be redirected to attacker-controlled HTML (UI:R in the CVSS vector - a single page load suffices, no clicks or downloads required). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 9.6 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated bug requiring only a user to load a page, with a changed scope that captures the sandbox escape. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious page (or compromises an ad network or a legitimate site via stored XSS) that delivers crafted HTML and JavaScript designed to trigger the Navigation use-after-free when the victim visits or is redirected to the page. Successful exploitation corrupts memory inside the browser process, allowing the attacker to escape the renderer sandbox and execute code with the browser's privileges on the user's machine, typically chained with a renderer RCE for a full one-click compromise. … |
| Remediation | Vendor-released patch: Google Chrome 149.0.7827.103 (Stable channel) - upgrade all desktop Chrome installations to this version or later via the Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, and restart the browser to load the new binary. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Issue organization-wide alert and prepare Chrome 149.0.7827.103 or later for deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today