EUVD-2026-50845
GHSA-42w5-9cqv-wq6x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryJavaScript grooms renderer heap
-
ExploitTrigger use-after-free in Input component
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open or navigate to an attacker-controlled HTML page in a vulnerable Chrome build (before 151.0.7922.72) - this user interaction (UI:R) is the primary limiting factor; there is no drive-by-without-interaction or authentication requirement (PR:N). No special browser configuration is needed as the vulnerable Input component is present in default installations. A key limiter is that code execution is confined to the renderer sandbox per the description, so achieving impact on the host OS additionally requires a chained sandbox-escape exploit not covered by this CVE. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects a network-reachable, low-complexity bug needing only that a user open a page, with full confidentiality/integrity/availability impact within the unchanged scope of the renderer. Counterbalancing this, the description limits execution to within the sandbox (S:U reflects no automatic scope change to the host), so real-world host compromise requires chaining a sandbox escape. EPSS is low (0.26%, 17th percentile), the CVE is NOT in CISA KEV, and no POC is referenced - these signals collectively indicate a legitimately serious but not yet actively exploited issue. For a browser as ubiquitous as Chrome, memory-corruption RCE bugs are routinely patched proactively and are strong candidates for later exploitation, so prompt patching is warranted despite the currently low EPSS; treat as high-priority routine patch rather than emergency. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted HTML/JavaScript that grooms the heap and triggers the use-after-free in Chrome's Input handling, then delivers the link via phishing, malvertising, or a compromised site. When a victim running a pre-151.0.7922.72 Chrome opens the page, the attacker gains arbitrary code execution within the renderer sandbox. No public POC is identified at time of analysis, and full host compromise would require pairing this with a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome desktop before version 151.0.7922.72 stems from a use-after-free in the browser's Input component (Chromium severity High, CVSS 8.8), permitting a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) but no authentication or prior privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.26% (17th percentile), consistent with a freshly patched browser bug not yet weaponized publicly.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so restart the browser to apply the pending update and verify via chrome://settings/help. Users of other Chromium-based browsers should update once their vendor ships the merged fix. Consult the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the tracking issue https://issues.chromium.org/issues/522304853. If immediate patching is not possible, compensating controls include enforcing 'Restart to update' policies via enterprise management, restricting browsing to trusted sites, and (as a heavier trade-off that degrades usability of many modern sites) disabling JavaScript for untrusted origins to hinder the heap grooming needed to exploit a use-after-free; none of these fully eliminate risk and patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Input subsystem, the component that dispatches and processes keyboard, mouse, touch, and pointer events between the browser and the Blink renderer. A use-after-free occurs when a heap object is freed but a dangling reference is subsequently dereferenced; an attacker who controls timing and heap layout via crafted HTML/JavaScript can reclaim the freed allocation with attacker-controlled data and hijack execution flow. Per the CPE (cpe:2.3:a:google:chrome:*), all Chrome desktop builds prior to 151.0.7922.72 are affected. Notably, the description scopes code execution to 'inside a sandbox,' meaning successful exploitation yields control of the renderer process, which is confined by Chrome's site-isolation/sandbox and would require a separate sandbox-escape bug to reach the host OS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page requires the user to visit it (UI:R) with no auth (PR:N); renderer-only execution keeps scope unchanged (S:U) with high C/I/A within the sandbox.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A remote code execution flaw in Google Chrome could enable unauthorized access to user browsers and organizational data through malicious webpages without requiring users to be authenticated or take special actions beyond normal browsing. While vendors have released patches and current exploitation risk remains low, the high technical severity (CVSS 8.8) and broad deployment of Chrome across the workforce justify prompt patching within days rather than weeks. Immediate action is needed to maintain a defensible security posture against this vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB