EUVD-2026-54264
GHSA-hxwh-3w5x-pvj2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable via a web page (AV:N) with no auth (PR:N) but requiring a victim visit (UI:R); reliable UAF exploitation and sandbox escape need heap grooming, so AC:H, and the escape crosses the sandbox boundary (S:C) with total impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Sandbox escape in Google Chrome for Linux (versions before 151.0.7922.109) stems from a use-after-free in the Aura windowing subsystem, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. Google rated the Chromium severity Critical (CVSS 9.6, scope-changed), but there is no public exploit identified at time of analysis and CISA's SSVC framework records exploitation status as 'none'. Because a full sandbox escape gives attacker code the privileges of the browser process on the host, this is a high-priority patch despite the absence of observed exploitation.
Technical ContextAI
Aura is Chromium's cross-platform windowing and UI abstraction layer that manages windows, input events, compositor surfaces, and widget lifecycles on Linux (and ChromeOS). A CWE-416 use-after-free occurs when a heap object is freed while a dangling pointer to it remains reachable; subsequent reuse of that pointer lets an attacker read or write freed memory, and by grooming the heap to place attacker-controlled data at the reclaimed address, an adversary can hijack control flow. The reported condition is that a crafted HTML page drives Aura into freeing an object still referenced elsewhere. The CVSS scope-change flag (S:C) is consistent with the described sandbox escape: the impact crosses the renderer's security boundary into the more privileged browser process/host. No specific CPE strings were provided, but the affected component is the desktop Chrome browser on Linux; the same rendering engine ships in Chromium-derived browsers, though only Chrome is named here.
RemediationAI
Vendor-released patch: 151.0.7922.109 - upgrade Google Chrome on Linux to 151.0.7922.109 or later, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html). Chrome normally auto-updates, so ensure the browser has been fully restarted to apply the new build, and verify the version via chrome://settings/help across managed fleets. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites, deploying enterprise policy to block untrusted/high-risk web content, and (where operationally acceptable) keeping the renderer sandbox strictly enabled - never launch Chrome with --no-sandbox, as that removes the very boundary this bug seeks to cross, at the cost of no isolation for renderer flaws. These are stopgaps only; the reliable fix is the version upgrade.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today