EUVD-2026-36336
GHSA-3w7f-7r56-w9w5
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:N for network-delivered HTML exploit; AC:H for mandatory prior renderer compromise; UI:R for victim page visit; C:H for process memory disclosure; I:N and A:N as no write or crash primitive is described.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Use-after-free in Google Chrome's Autofill component (versions prior to 149.0.7827.115) enables attackers who have already compromised the renderer process to read sensitive data from process memory via a crafted HTML page. Exploitation is a chained, multi-stage attack: the Autofill UAF is a post-exploitation primitive, not a standalone entry point, which substantially limits its real-world impact despite the CVSS C:H rating. No public exploit identified at time of analysis; SSVC confirms exploitation status as 'none' and EPSS sits at the 8th percentile, consistent with low observed threat activity.
Technical ContextAI
CWE-416 (Use After Free) describes a class of memory-safety bug where a program continues to reference heap memory after it has been freed, allowing an attacker to control what that memory contains at the time of access. Here the flaw resides in Chrome's Autofill subsystem - the component responsible for form-filling and credential suggestions - which runs inside the renderer process. Chrome's multi-process sandbox architecture means the renderer is already an isolated, lower-privilege process; however, a compromised renderer can still interact with Autofill internals and trigger this UAF to leak data from its own process memory. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome builds prior to the 149.0.7827.115 stable release.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.115 or later, as confirmed by the vendor release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html. Chrome's auto-update mechanism will deliver this patch to most users without manual intervention; administrators managing enterprise deployments should verify update policy enforcement. No workaround is available that mitigates the UAF itself, as disabling Autofill entirely is a trade-off that reduces usability but does not prevent renderer compromise via other means. Organizations with high-value targets should prioritize patching over workarounds given Chrome's ubiquitous deployment footprint.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today