EUVD-2026-50784
GHSA-qp73-3238-xr3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML/JS page
-
DeliveryLure victim to open page in Chrome
-
ExploitTrigger use-after-free in V8
-
ExecutionReuse freed heap object
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load a crafted HTML/JavaScript page in a vulnerable Chrome build (< 151.0.7922.72) - the CVSS UI:R confirms mandatory user interaction, which is the primary limiting factor. No authentication is required (PR:N) and no non-default configuration is needed: default Chrome installs execute the attacker-controlled JavaScript that drives the V8 use-after-free. Two further factors limit realistic impact: code execution is confined to the renderer sandbox (S:U), so a standalone exploit does not by itself yield host-level control without an additional sandbox-escape bug, and the victim must be running an unpatched version, since the fixed build closes the flaw. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting a malicious page) and stays within the renderer's scope (S:U) with high confidentiality, integrity, and availability impact. Counterbalancing signals lower the immediate real-world urgency: EPSS is only 0.35% (28th percentile), there is no CISA KEV listing, and no public exploit has been identified - so this is not currently evidence of widespread exploitation. Importantly, the description states code execution occurs 'inside a sandbox,' meaning a single-bug renderer compromise still requires a separate sandbox-escape to fully compromise the host; this materially reduces standalone impact versus the raw 8.8 score. Given Chrome's ubiquity and V8's historical value as an exploitation target, this should still be patched promptly, but present data points to prudent-but-not-emergency prioritization rather than a confirmed in-the-wild threat. |
| Exploit ScenarioDerived | An attacker registers or compromises a website and embeds malicious JavaScript that manipulates V8 object lifetimes to trigger the use-after-free, then phishes or otherwise entices a victim to open the page. Because AC is low and no authentication is needed, simply rendering the crafted HTML corrupts memory and can execute attacker code within the renderer sandbox; full host compromise would require chaining a separate sandbox escape. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8, requiring user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched, vendor-reported bug rather than one under active exploitation.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; verify the exact fixed build for your platform in Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments, force the update by pushing the new package or setting policy to auto-update, then relaunch the browser so the new V8 binary is loaded (a restart is required for the fix to take effect). Until updates roll out, reduce exposure by restricting browsing to trusted sites, enabling a stricter Site Isolation posture, and considering enterprise policies that limit untrusted JavaScript execution - trade-off being reduced usability on legitimate sites; disabling JavaScript entirely would block the vector but breaks most modern web applications and is generally impractical. Users of other Chromium-based browsers should apply their vendor's corresponding update once it incorporates the fixed V8.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in V8, the C++ JavaScript and WebAssembly engine that powers Chrome and all Chromium-derived browsers. Use-after-free (CWE-416) occurs when the engine continues to reference a heap object after it has been freed - in V8 this is typically triggered by JavaScript that manipulates object lifetimes (e.g., during garbage collection, optimization/deoptimization, or type transitions) so that a dangling pointer is later dereferenced. An attacker who controls the freed-then-reused memory can groom the heap to place attacker-chosen data where the stale pointer points, yielding memory corruption that can be steered into control-flow hijack. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome desktop application; the same code is present in other Chromium-based browsers, though only Chrome is named here.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered malicious page needs no auth (PR:N) but requires the victim to open it (UI:R); code runs in the renderer sandbox so scope unchanged (S:U) with full CIA impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A remote code execution vulnerability in Google Chrome's V8 engine (CVE-2026-17658) allows attackers to execute arbitrary code on users' systems through malicious webpages; no public exploit identified at time of analysis. With CVSS 8.8 severity and Chrome's widespread adoption, this poses material risk to organizational systems and requires immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB