EUVD-2026-50636
GHSA-pgpx-v7pf-c78w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
DeliveryInduce specific tab UI gestures
-
ExploitTrigger TabStrip use-after-free
-
ExecutionGroom heap via reclaimed object
-
ImpactCorrupt heap for code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to visit an attacker-controlled crafted HTML page in a vulnerable Chrome build (<151.0.7922.72) AND to perform specific UI gestures that drive the TabStrip into the use-after-free state (UI:R). Limiting factors: the attack is high-complexity (AC:H), depends on user interaction that cannot be triggered by page content alone, and requires heap grooming to weaponize the freed object; no authentication is needed (PR:N) but the required manual interaction and complexity substantially constrain real-world exploitation. |
| Impact | The signals point to a real-but-not-urgent issue. The CVSS 3.1 base score is 7.5 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - network reachable and unauthenticated, but with high attack complexity and required user interaction (the victim must perform specific UI gestures), which materially limits practical exploitability. EPSS is low (0.22%, 12th percentile) and CISA's SSVC framework reports Exploitation: none, Automatable: no, Technical Impact: partial, all consistent with a non-wormable, targeted-at-best bug. There is no KEV listing and no public exploit identified at time of analysis. Note a mild tension: the CVSS lists C:H/I:H/A:H (full impact) while Chromium labels the severity Medium and SSVC calls technical impact only partial - treat the C/I/A:H rating as the theoretical ceiling of a UAF rather than demonstrated full compromise. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and socially engineers a Chrome user into visiting it and performing particular tab/UI interactions, which trigger the TabStrip use-after-free and corrupt the heap. With careful heap grooming the attacker could turn the dangling pointer into code execution in the browser, but the required user gestures and high complexity make reliable exploitation difficult; no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Heap corruption in the TabStrip component of Google Chrome desktop before 151.0.7922.72 allows a remote attacker to trigger a use-after-free (CWE-416) when a user is lured to a crafted HTML page and performs specific UI gestures. Successful exploitation could lead to arbitrary code execution within the renderer process, though Chromium rates the severity as Medium and there is no public exploit identified at time of analysis. EPSS is low at 0.22% (12th percentile) and CISA SSVC records exploitation status as none.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; on most installs this happens automatically but should be forced by navigating to chrome://settings/help and relaunching. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the tracker at https://issues.chromium.org/issues/523717010. Because exploitation requires visiting a malicious page and performing UI gestures, interim compensating controls include enforcing browser auto-update policies enterprise-wide, restricting or web-filtering untrusted sites, and cautioning users against unexpected tab-manipulation prompts; these reduce exposure but do not eliminate the underlying bug, so patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's TabStrip, the browser-UI component that manages the row of open tabs. Use-after-free bugs occur when a heap object is freed while a dangling pointer to it remains in use, letting an attacker reclaim and control that freed memory to corrupt the heap. The affected surface is the desktop Chrome browser (CPE cpe:2.3:a:google:chrome), and because TabStrip is browser-process/UI-adjacent, the trigger depends on user-driven interface actions rather than pure content parsing, which raises exploitation complexity relative to a typical renderer bug.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N) but needs specific user gestures and heap grooming (AC:H, UI:R), no auth (PR:N); UAF can yield full renderer compromise (C/I/A:H).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A vulnerability in Google Chrome desktop (CVE-2026-17887) could allow attackers to execute code on users' systems when they visit a malicious webpage; no public exploit identified at time of analysis. While the risk of immediate exploitation is low, the potential for code execution poses significant business risk to any organization relying on Chrome. All desktop Chrome users should update to version 151.0.7922.72 or later to mitigate this risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB