EUVD-2026-54119
GHSA-rx36-fm6w-x79j
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects mandatory renderer pre-compromise; S:C captures sandbox escape crossing privilege boundary; PR:N because no credentials needed for initial delivery.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome's Aura display layer on Linux allows a remote attacker with an already-compromised renderer process to break out of the Chrome sandbox via a crafted HTML page, achieving full system-level code execution. Affected versions are all Chrome builds prior to 151.0.7922.109 on Linux. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS scope-changed rating (S:C) and High across C/I/A reflect the severe post-exploitation impact of a successful sandbox escape in a privileged browser context.
Technical ContextAI
Aura is Chrome's cross-platform windowing and UI composition framework, used on Linux and ChromeOS as the primary display layer between the browser process and the OS graphics stack. CWE-416 (Use After Free) indicates that a heap-allocated Aura object is freed while a reference to it remains live, and a subsequent dereference of that stale pointer enables an attacker to control execution flow - classically achieved by reclaiming the freed memory region with attacker-controlled data before the dangling pointer is dereferenced. In a multi-process Chromium architecture, the renderer runs in a sandboxed process with heavily restricted OS privileges; exploiting a UAF in Aura - which runs in the more-privileged browser process - allows the attacker to cross the IPC boundary and escape those restrictions. The affected CPE is Chrome for Linux prior to version 151.0.7922.109, as confirmed by EUVD-2026-54119.
RemediationAI
Update Google Chrome for Linux to version 151.0.7922.109 or later, which contains the vendor-released patch per the Stable Channel Update advisory at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome typically auto-updates, but administrators should verify managed fleet versions via policy or telemetry. If immediate patching is not feasible, organizations can reduce exposure by blocking delivery of arbitrary web content through strict URL filtering or disabling access to untrusted external sites for sensitive Linux endpoints. Note that these compensating controls address only the delivery phase - they cannot prevent exploitation if a renderer is compromised through an internal or trusted-site vector. Site isolation policies (already enabled by default in modern Chrome) provide partial layered defense but do not remediate this specific UAF.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today