EUVD-2026-42455
GHSA-9rvx-ch9v-838r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs user interaction (UI:R) but no auth (PR:N); high C/I/A reflect full code execution within the unchanged-scope renderer sandbox.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandboxed remote code execution in Google Chrome versions prior to 150.0.7871.115 stems from a use-after-free in the Forms component, allowing a remote attacker to run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw carries a High Chromium severity rating and CVSS 8.8; Google has shipped a stable-channel fix, but no public exploit has been identified at time of analysis. Because code execution is confined to the sandbox, a separate sandbox-escape bug would be required for full host compromise.
Technical ContextAI
The vulnerability is a CWE-416 use-after-free in Chrome's Forms handling, part of the Blink rendering engine that processes HTML form elements (inputs, form submission, autofill, and DOM lifecycle events). Use-after-free bugs arise when a heap object is freed but a dangling pointer to it is later dereferenced - in browsers this is typically triggered by DOM manipulation during event callbacks or reentrancy, where script mutates or destroys form objects while the engine still holds references. An attacker who controls the freed-then-reallocated memory can groom the heap to place attacker-influenced data where the stale pointer expects a valid object, redirecting control flow. Chrome runs renderer processes in a sandbox, so the description's phrasing 'inside a sandbox' indicates the primitive yields execution in the constrained renderer context rather than the host OS.
RemediationAI
Update Google Chrome to version 150.0.7871.115 or later on all desktop platforms; this is a vendor-released patch delivered through Chrome's automatic update channel, so verify the update applied by opening chrome://settings/help and relaunching the browser to complete installation, as staged updates do not take effect until restart. Users of Chromium-based browsers should apply their vendor's corresponding update once it rebases onto the fixed Chromium build. If immediate patching is not possible in a managed environment, compensating controls include enforcing Chrome's Site Isolation (default) to keep renderer processes separated, and reducing exposure by restricting browsing to trusted sites via enterprise policy or web filtering - noting these reduce but do not eliminate risk from a malicious page, and browsing restrictions can disrupt legitimate workflows. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today