EUVD-2026-50611
GHSA-776x-g92c-pvpp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious file to local user
-
DeliveryUser opens file in Chrome on Windows
-
ExploitTrigger use-after-free in Tracing
-
ExecutionCorrupt heap and hijack execution
-
ImpactEscalate to OS-level privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local delivery of a specially crafted malicious file to the target and requires the victim user to open/process that file in Google Chrome on Windows (CVSS UI:R), triggering the use-after-free in the Tracing component; no prior authentication or privileges are needed (PR:N). Limiting factors: the attack vector is local (AV:L) rather than remote, mandatory user interaction gates exploitation, and the flaw is platform-specific to the Windows build of Chrome versions before 151.0.7922.72 - it does not apply to already-patched installs or (per the description) to other operating systems. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) describes a local, low-complexity attack needing no prior privileges but requiring user interaction, with high impact to all three security properties - consistent with the description's 'local attacker via a malicious file.' Note the discrepancy between Chromium's own 'Medium' severity rating and the 7.8 'High' CVSS: Chromium's grading reflects the browser-security model, while the CVSS reflects OS-level impact once triggered, so both are defensible. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, and no public exploit is identified at time of analysis; combined with the local attack vector and required user interaction, real-world risk is moderate and dependent on social engineering rather than remote mass exploitation. Priority is driven mainly by Chrome's ubiquity plus the availability of a straightforward patch, which makes patching low-cost and worthwhile despite the absence of active-exploitation signals. |
| Exploit ScenarioDerived | An attacker crafts a malicious file and uses social engineering (phishing, malicious download) to get a local user to open it in an unpatched Chrome on Windows; opening the file triggers the use-after-free in the Tracing component, corrupting heap memory. The attacker leverages this to execute code that escalates to OS-level privileges on the machine. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means a working exploit, once developed, would be reliable given the required user interaction (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Local privilege escalation in Google Chrome for Windows before 151.0.7922.72 stems from a use-after-free in the Tracing component (CWE-416), letting a local attacker who lures a user into opening a malicious file execute code that escalates to OS-level privileges. Chromium rates the security severity as Medium, but the assigned CVSS 3.1 score is 7.8 (High) reflecting full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Windows; Chrome typically auto-updates, but administrators should force the update and relaunch the browser to apply it, verifying via chrome://settings/help and consulting the advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation requires the victim to open a malicious file, interim compensating controls include restricting or blocking the delivery and opening of untrusted files (e.g., email attachment filtering and download restrictions) and enforcing least privilege so a successful exploit yields less on the host - though these do not remove the underlying use-after-free and add operational friction. Given a fix already exists, patching is the definitive remediation and should not be deferred in favor of workarounds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Chrome's Tracing subsystem, the instrumentation/telemetry framework (trace-event and Perfetto-based profiling) used for performance diagnostics within the browser. The root cause is a use-after-free (CWE-416): an object is freed while a dangling reference remains, and subsequent access to that freed memory allows an attacker to control freed heap contents and corrupt program state. Per the CPE data (cpe:2.3:a:google:chrome), the affected artifact is the Chrome application itself on Windows; the tags (Use After Free, Memory Corruption, Privilege Escalation) corroborate a heap memory-corruption primitive that, in this Windows-specific case, is leveraged to cross into OS-level privilege rather than remaining a browser-sandbox escape.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file delivery gives AV:L; victim must open the file so UI:R; no privileges needed (PR:N); OS-level privilege escalation yields C:H/I:H/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for Windows versions prior to 151.0.7922.72 contain a local privilege escalation vulnerability that enables an attacker to gain OS-level system access if a user opens a malicious file. This threatens endpoint security across all Windows-based Chrome users, potentially compromising sensitive business data and enabling lateral movement into critical systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB