EUVD-2026-50820
GHSA-xwr8-52r2-77wh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure victim to visit (UI)
-
ExploitTrigger DOM use-after-free
-
ExecutionReclaim freed object via heap grooming
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (before 151.0.7922.72) - user interaction (UI:R) in the form of visiting or being redirected to a malicious/compromised page is mandatory, so this is not a zero-click drive-by against a passive target. No authentication and no special browser configuration are needed (PR:N; default Stable-channel Chrome is affected), but code execution is limited to the renderer sandbox, meaning an attacker gains no host-level control from this bug alone and must chain a separate sandbox escape to break out. The practical limiting factors are therefore: required user interaction, the need for a patched-or-not version window, and the sandbox containment boundary. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting a malicious page) and does not cross a privilege/scope boundary - consistent with the description's note that code runs 'inside a sandbox.' This is a meaningful contrast: the raw score is high, but Scope:Unchanged plus sandboxed execution means a single bug here does not by itself yield host takeover without a chained sandbox escape. EPSS is low (0.35%, 28th percentile) and the CVE is not listed in CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was provided. Net: this is a legitimately important browser patch (memory-corruption RCE in the renderer) that should be remediated promptly under normal browser-update cadence, but current signals point to no active mass exploitation rather than an emergency zero-day. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/JavaScript that manipulates DOM objects to trigger the use-after-free, then delivers it via a phishing link, malvertising, or a watering-hole site. When a victim running a pre-151.0.7922.72 Chrome build visits the page (the required user interaction), the dangling pointer is exploited to gain code execution inside the renderer sandbox. No public POC is referenced, and full system compromise would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 arises from a use-after-free in the DOM implementation, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. The flaw was reported internally by the Chrome team, rated High by Chromium, and carries CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is low at 0.35% (28th percentile). Because execution is confined to the sandbox (Scope: Unchanged), full host compromise would additionally require a separate sandbox-escape chain.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome staged updates do not take effect until relaunch. In managed fleets, push the update via Chrome Browser Cloud Management / group policy and force a relaunch to guarantee the vulnerable process is retired. If immediate patching is not possible, reduce exposure by limiting browsing to trusted sites, enabling Chrome's Enhanced Safe Browsing (which adds real-time malicious-page checks at the cost of sending more telemetry to Google), and considering site-isolation/strict rendering policies - but note none of these are a substitute for the fix, since the trigger is simply loading a crafted HTML page. For Chromium-based derivatives, apply the corresponding upstream-based release from that vendor once available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a CWE-416 use-after-free in Chrome's DOM engine (Blink), the component that parses HTML and maintains the live in-memory Document Object Model. Use-after-free occurs when C++ code retains and dereferences a pointer to a DOM object (node, element, or associated allocation) after it has been freed - typically triggered by script-driven mutation, event callbacks, or garbage-collection timing during page rendering. An attacker who controls the freed-then-reused memory can groom the heap to place attacker-controlled data where a dangling pointer is dereferenced, converting the dangling reference into a controlled read/write and ultimately code execution in the renderer process. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e., the Google Chrome desktop browser on the Stable channel.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page (AV:N/AC:L/PR:N) requiring the victim to open it (UI:R); renderer-sandbox execution keeps scope unchanged (S:U) with high C/I/A in-process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in DOM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
A use-after-free vulnerability in Google Chrome (CVE-2026-17694, CVSS 8.8) enables remote code execution when users visit attacker-controlled websites. Execution is confined to Chrome's sandbox, mitigating direct OS compromise; however, the flaw affects all Chrome desktop users running versions before 151.0.7922.72 and enables browser-level data theft and malware installation. Leadership should prioritize rapid patching to protect user credentials and organizational access across Windows, macOS, and Linux endpoints.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB