EUVD-2026-50643
GHSA-84j6-88rr-f5r4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryTrigger use-after-free in Views subsystem
-
ExploitReallocate freed object with controlled data
-
ExecutionCorrupt heap in renderer process
-
ImpactAchieve code execution / total process impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open or navigate to attacker-controlled HTML content in Google Chrome on Linux (CVSS UI:R), so it cannot succeed without user interaction - this is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and the target must be running a vulnerable Chrome build below 151.0.7922.72 on Linux specifically. Limiting factors: the requirement for user interaction rules out fully automated mass exploitation (SSVC Automatable=no), and Chrome's multi-process sandbox means a Views/renderer memory-corruption primitive would typically need an additional sandbox-escape to achieve full system compromise. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) reflects unauthenticated remote reach with low complexity but requires user interaction, capping automatability. That aligns with the SSVC assessment: Exploitation=none, Automatable=no, Technical Impact=total - meaning that while a successful exploit yields full control of the process, no active exploitation is observed and mass automated abuse is unlikely. Signals are internally consistent rather than conflicting: low EPSS (0.18%, 8th percentile), no KEV listing, and no public POC all point to real-but-not-imminent risk. Chromium's internal rating of Medium is notably lower than the NVD-style 8.8, a common divergence where Chrome's severity accounts for exploit practicality and sandboxing while CVSS scores raw impact; defenders should treat this as a routine-priority browser patch rather than an emergency, but still patch promptly given Chrome's ubiquity and the total technical impact. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page (or injects it via a malvertising frame) and entices a Linux Chrome user to open it. The page drives a sequence of UI/Views operations that frees an object still referenced elsewhere, then reallocates that memory with attacker-influenced data to corrupt the heap, potentially leading to arbitrary code execution in the renderer. No public exploit is identified at time of analysis, and success requires the victim's interaction of visiting the page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Heap corruption in Google Chrome's Views UI framework on Linux affects all versions prior to 151.0.7922.72, where a remote attacker can leverage a use-after-free by luring a victim to a crafted HTML page. Because exploitation requires the user to visit malicious content (UI:R), it is not fully automatable, and there is no public exploit identified at time of analysis; EPSS estimates only a 0.18% exploitation probability (8th percentile) and SSVC records exploitation status as none. Chromium rated the underlying issue Medium severity, though the CVSS base score is 8.8 due to high confidentiality, integrity, and availability impact if successfully exploited.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Linux via the Stable channel (relaunch the browser to complete the update), per https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because Chrome auto-updates, ensure background updates are not disabled in managed/enterprise fleets and force a policy-driven update where necessary; verify the running version under chrome://settings/help. As an interim compensating control before patching, restrict users from browsing untrusted sites and consider enforcing site isolation and the renderer sandbox (default-on) to raise exploitation cost - note this does not remediate the flaw and only reduces likelihood of a successful chain. Downstream Chromium-based browsers on Linux should be updated to a build incorporating the equivalent Views fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Views, Chromium's cross-platform C++ UI toolkit used to render browser chrome and native widgets rather than web page content. The root cause is CWE-416 (Use After Free): an object in the Views subsystem is freed while a dangling reference remains reachable, and subsequent access to that stale pointer corrupts the heap. Attacker-controlled HTML/JS can drive the sequence of UI operations that triggers the premature free and reuse, giving the attacker influence over the contents of the freed-then-reallocated memory. Per the CPE (cpe:2.3:a:google:chrome:*), the affected artifact is the Google Chrome desktop application, with this advisory specifically scoping the Linux build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the victim to open it (UI:R); a UAF yielding code execution gives high C/I/A within the unchanged process scope.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on Linux versions below 151.0.7922.72 contain a use-after-free vulnerability (CVSS 8.8) capable of enabling arbitrary code execution if exploited. No public exploit identified at time of analysis, with EPSS scoring at only 0.2%, reflecting low real-world exploitation likelihood due to required user interaction and low exploit availability. Organizations should apply the available vendor patch to eliminate this risk vector before exploit tooling emerges in the threat landscape.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB