EUVD-2026-50635
GHSA-qgw6-jjq5-76g9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage triggers use-after-free in Enterprise component
-
ExploitReclaim freed heap allocation
-
ExecutionCorrupt heap with controlled data
-
ImpactAttempt code execution in renderer
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open or be redirected to an attacker-controlled HTML page in a vulnerable Chrome build (prior to 151.0.7922.72) - the CVSS UI:R confirms mandatory user interaction, which is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and the attack is network-delivered against default Chrome configurations, but the trigger resides in the Enterprise component code path. What limits real-world risk: the need for user interaction, the scope-unchanged (S:U) rating implying no automatic sandbox breakout, and Google's Medium severity rating plus SSVC 'Automatable: no' indicating exploitation is neither trivial nor self-propagating. |
| Impact | Signals here are mixed and should be weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting a page) and yields high impact on confidentiality, integrity, and availability. Against that, real-world exploitation signals are low: EPSS is 0.18% (8th percentile), CISA SSVC records Exploitation: none and Automatable: no (though Technical Impact: total), this is not in CISA KEV, and no public POC is identified. Google's own Chromium rating is only Medium, which is notably lower than the 8.8 base score and suggests the practical exploitability (e.g., difficulty of turning the UAF into reliable RCE, or sandbox constraints) is more limited than the raw CVSS implies. Net: this is a standard-priority browser patch - worth deploying in normal patch cycles rather than an emergency, absent evidence of exploitation. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page (or injects it via a malicious ad or compromised site) and lures a Chrome user to visit it. The page triggers the use-after-free to corrupt heap memory in the browser process, which the attacker leverages to attempt arbitrary code execution within Chrome's sandbox. No public POC is currently identified, and reliable exploitation would likely require chaining an additional sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Heap corruption via use-after-free in Google Chrome's Enterprise component allows a remote attacker to potentially execute arbitrary code when a victim visits a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Google rates the Chromium severity as Medium, but the CVSS 8.8 reflects full compromise of the browser process on successful exploitation; there is no public exploit identified at time of analysis and EPSS probability is low (0.18%). A vendor patch is available in the 151.0.7922.72 stable channel.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html; on most deployments Chrome auto-updates, so verify the version under chrome://settings/help and relaunch to apply. In managed enterprise fleets, push the update through your management tooling (e.g., Chrome Browser Cloud Management or OS patch management) and force a relaunch, since users who never restart the browser remain exposed. No specific vendor workaround is published; as an interim compensating control you can restrict browsing to trusted sites or enforce Chrome's site isolation and safe-browsing policies, accepting the trade-off that these reduce but do not eliminate exposure to a crafted-page attack.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 Use-After-Free in the Enterprise component of Chromium, the open-source engine underpinning Google Chrome (CPE cpe:2.3:a:google:chrome). Use-after-free occurs when a pointer to heap memory continues to be used after that memory has been freed, letting an attacker reclaim the freed allocation with attacker-controlled data and corrupt the heap. In a browser context, an attacker triggers the dangling reference from JavaScript/HTML rendering, and Chrome's high-value renderer process makes such bugs a common stepping stone toward code execution, typically requiring a further sandbox escape for full system compromise. The 'Enterprise' subsystem indicates the vulnerable code path relates to Chrome's managed/policy features rather than the core DOM.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page with no auth (AV:N/PR:N) but mandatory user interaction (UI:R); a UAF enabling code execution gives high C/I/A within the unchanged browser process scope.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability in the browser's core component; a threat actor could execute arbitrary code within the browser process when employees visit a crafted webpage, potentially compromising confidential data and enabling lateral system access. While current exploitation probability remains low (0.2% EPSS), the high severity rating (CVSS 8.8) requires immediate patching to secure this critical user-facing attack surface.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB