EUVD-2026-39584
GHSA-m28g-h5xq-jc4p
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical access is the confirmed attack vector per description; no privileges or user interaction needed once device is held; full C/I/A impact via heap corruption within browser scope.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a local attacker to potentially exploit heap corruption via physical access to the device. (Chromium security severity: High)
AnalysisAI
Use-after-free memory corruption in Google Chrome's Payments component on Android (prior to 149.0.7827.201) enables a local attacker with physical access to the device to trigger heap corruption, yielding high impact across confidentiality, integrity, and availability. The physical-access requirement (CVSS AV:P) substantially constrains the exploitable population to scenarios such as unattended or stolen devices. No public exploit identified at time of analysis, and no CISA KEV listing exists, indicating this has not been observed in active exploitation campaigns.
Technical ContextAI
CWE-416 (Use After Free) describes a class of memory-safety defect where a program continues to reference heap-allocated memory after it has been freed, allowing an attacker to influence the contents of that memory region before it is re-used and then trigger reads or writes through the dangling pointer. Here the flaw resides in Chrome's Payments subsystem - the browser component handling autofill, stored payment methods, and payment request flows - on the Android platform specifically (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). Because Chrome on Android runs in a sandboxed process model, successful heap corruption would typically require a separate sandbox-escape primitive to reach full OS-level impact, though the CVSS vector does not reflect a scope change, implying the reported impact is bounded to the browser's own process space.
RemediationAI
Update Google Chrome on Android to version 149.0.7827.201 or later. The patch is confirmed available from Google per the Stable Channel Update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01245939337.html. On Android, Chrome updates are delivered via the Google Play Store - administrators managing enterprise Android fleets should push the update through their MDM solution and verify deployment via device compliance policies. As a compensating control pending update, organizations with high-value devices should enforce full-disk encryption and screen lock so that physical-access exploitation requires bypassing device authentication first, raising the practical attack bar. Disabling the Chrome Payments/Autofill feature (via Chrome policy AutofillCreditCardEnabled=false) may reduce the attack surface within the vulnerable component, though this trades off user convenience and has not been confirmed by Google as a definitive mitigation.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today