EUVD-2026-39034Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page (AV:N), no privileges (PR:N) but requires visiting the page (UI:R); renderer-only RCE keeps scope unchanged (S:U) with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Remote code execution in Google Chrome's Blink rendering engine (InterestGroups component, part of the Privacy Sandbox/Protected Audience ad-auction API) affects all desktop versions prior to 149.0.7827.197. A crafted HTML page triggers an out-of-bounds read and write that a remote attacker can leverage to execute arbitrary code in the renderer; Chromium rates this Critical and assigns CVSS 8.8. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to actively load attacker-controlled HTML/JavaScript in a vulnerable Chrome build (UI:R - user interaction such as visiting a page or rendering a malicious iframe/ad), and the page must drive the Blink InterestGroups (Protected Audience / FLEDGE) code path to trigger the OOB read/write. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent toward a real but not yet urgent-in-the-wild priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious web page (or compromises an ad/iframe) containing JavaScript that exercises the Protected Audience InterestGroups API in a way that triggers the out-of-bounds read/write. A victim simply visiting the page corrupts renderer memory, which the attacker grooms to gain arbitrary code execution within the sandboxed Chrome renderer. … |
| Remediation | Vendor-released patch: update Google Chrome to 149.0.7827.197 or later via the Stable channel; on most installs this is automatic after relaunch, so the actionable step is to force-update through chrome://settings/help and restart the browser to apply it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Deploy Chrome version 149.0.7827.197 or later to all endpoints via your software distribution system (WSUS, Intune, Jamf, or equivalent). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today