EUVD-2026-50667
GHSA-qj3x-9f7x-j3vf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage triggers use-after-free in Sync
-
ExploitReclaim freed object with controlled data
-
ExecutionCorrupt memory via dangling pointer
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open or navigate to an attacker-controlled HTML page (CVSS UI:R), so it is not fully drive-by against an idle browser - user interaction gates the attack. No authentication is required (PR:N) and no special server-side configuration is needed; default Chrome installs prior to 151.0.7922.72 are exploitable. The key LIMITING factor is that successful code execution is confined to Chrome's renderer sandbox - full host compromise additionally requires a separate sandbox-escape vulnerability that is not part of this CVE. The bug is in the Sync subsystem, and Chromium rated the severity Low. |
| Impact | The signals are mixed and should temper the headline CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) indicates a network-reachable, unauthenticated, low-complexity bug requiring only that the user open a page - a realistic scenario for a browser. However, three factors lower real-world urgency: Chromium itself assigned a security severity of Low; the description explicitly limits impact to code execution 'inside a sandbox,' meaning a separate sandbox-escape chain would be required to compromise the host; and EPSS is only 0.21% (12th percentile), consistent with no active exploitation. There is no CISA KEV listing and no public exploit identified. Note the tension between the 8.8 CVSS and the vendor's Low severity - the CVSS scope (S:U) and the sandbox confinement are why this is not the emergency the raw score suggests. Treat it as routine browser patch hygiene rather than a fire-drill. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects malicious content into an ad or compromised site) and lures a Chrome user to visit it. The page triggers the use-after-free in the Sync code path, corrupting memory and executing attacker-controlled code inside the Chrome sandbox; to affect the host, the attacker would then need to chain a separate sandbox-escape bug. No public exploit is available at time of analysis, and the low complexity (AC:L) means a working exploit, once developed, would be reliable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome's Sync component (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a CWE-416 use-after-free reported internally by the Chrome team; it carries a CVSS 8.8 but Chromium rated the security severity as Low, and code execution is confined to the sandbox rather than the host OS. No public exploit has been identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later; the fix ships via the stable channel update documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments, verify auto-update is enabled and force a relaunch to apply the new binary, since the patch only takes effect after Chrome restarts. Where immediate patching is not possible, the practical compensating control is to ensure the sandbox is not disabled (do not run with --no-sandbox), which contains the arbitrary code execution to the renderer; you may also reduce exposure by restricting browsing to trusted sites via policy or web filtering, at the cost of user friction. Disabling the Chrome Sync feature is a plausible targeted mitigation given the flaw is in the Sync component, though the crafted-HTML trigger means page rendering is the exposure surface, so patching remains the only complete fix. Additional tracking reference: https://issues.chromium.org/issues/513127137.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's Sync feature, the subsystem that reconciles bookmarks, history, passwords, tabs and settings across a user's signed-in devices. The root cause is CWE-416 (use-after-free): an object is freed while a dangling pointer to it is still reachable, allowing an attacker to reallocate the freed memory with controlled data and hijack subsequent dereferences to corrupt memory and gain execution. Because this lives in the renderer/browser process code path exercised by page content, an attacker-controlled HTML page can drive the freed-then-reused object into a state that yields arbitrary code execution within Chrome's sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering the Chrome desktop stable channel.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable crafted page (AV:N), no auth (PR:N), user must open the page (UI:R), low complexity (AC:L); high renderer impact but no scope change since execution stays in the sandbox (S:U).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability (CVE-2026-17918) that could compromise user browser sessions when employees visit malicious websites. Although the vulnerability is limited to Chrome's sandboxed environment and current exploitation likelihood is low at 0.2% EPSS, the ubiquity of Chrome across the organization and potential for credential theft or data exfiltration justify rapid patching. A vendor-released patch is available and deployment should be completed within 30 days.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB