EUVD-2026-40715
GHSA-2xhc-pmcp-mwpw
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N) with no privileges (PR:N) but requiring victim UI gestures (UI:R); heap-corruption-to-RCE justifies C/I/A:H, though 'specific gestures' arguably approaches AC:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Use-after-free in Google Chrome's SignIn component (versions prior to 150.0.7871.47) allows a remote attacker to trigger heap corruption and potentially achieve code execution after luring a victim to a crafted HTML page and performing specific UI gestures. No public exploit was identified at time of analysis, and with an EPSS of 0.17% (7th percentile) and Chromium-rated 'Low' severity, near-term mass exploitation appears unlikely despite the high 8.8 CVSS. The flaw is patched in the current stable channel and is not listed in CISA KEV.
Technical ContextAI
The vulnerability is a CWE-416 Use-After-Free in Chrome's SignIn subsystem, the browser-side component that manages Google account authentication, profile linkage, and sync sign-in flows. A use-after-free occurs when a heap object is freed but a dangling pointer to it is later dereferenced; in a renderer/browser context this lets an attacker reclaim the freed allocation with attacker-controlled data, corrupting the heap and enabling control-flow hijacking. Chrome is built on the Chromium engine (Blink rendering, V8 JavaScript), so the same defect affects other Chromium-derived browsers that share the code (e.g., Edge, Brave, Opera) until they pick up the upstream fix. The internal Chromium tracker issues.chromium.org/issues/361375787 corresponds to this bug; affected component is SignIn per the vendor's own attribution (chrome-cve-admin@google.com).
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Chrome Releases Stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). In managed environments, confirm auto-update is enabled and force a relaunch so the new binary loads, since Chrome only applies pending updates on restart; verify via chrome://settings/help. Users of other Chromium-based browsers should apply their vendor's build once it incorporates the upstream fix. If patching must be deferred, the practical compensating control for this SignIn use-after-free is user-behavior and exposure reduction: because exploitation requires the victim to visit attacker-controlled HTML and perform specific UI gestures, restrict browsing to trusted sites, enable enterprise policies that limit navigation, and consider disabling/limiting the browser sign-in flow via policy (e.g., BrowserSignin) where feasible - the trade-off is loss of profile sync convenience. There is no fully equivalent workaround to patching; these controls only reduce the interaction surface, not eliminate the defect.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today