EUVD-2026-20693
GHSA-px27-v386-gc8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious media content delivered
-
ExploitTrigger use-after-free in Media component
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled content - the CVSS vector's UI:R confirms user interaction (visiting or being redirected to a crafted HTML page) is mandatory, which prevents fully automated/wormable attacks (SSVC Automatable: no). No authentication or special privileges are needed (PR:N), and the affected Media component is present in default Chrome configurations, so no non-default setting is required. The principal limiting factor is that code execution is confined to the renderer sandbox (S:U, description states 'inside a sandbox'); achieving host-level compromise additionally requires a separate sandbox-escape primitive not covered by this CVE. Affected population is limited to Chrome desktop builds below 147.0.7727.55. |
| Impact | Signals here diverge and should be weighed together. CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - network reachable, low complexity, no privileges, but requiring user interaction (visiting a page). Against that, EPSS is very low at 0.04% (11th percentile), the CISA SSVC framework records Exploitation: none and Automatable: no (user interaction defeats automation), and there is no KEV listing and no public exploit identified at time of analysis. The one signal pushing severity up is SSVC Technical Impact: total, reflecting full renderer compromise. A key caveat: the CVSS S:U (scope unchanged) plus the description's explicit 'inside a sandbox' wording indicate the impact is confined to the sandboxed renderer - real-world host compromise would require chaining a separate sandbox escape, which this CVE does not provide. Net: this is a routine-but-important browser memory-corruption patch, not an emergency; prioritize normal Chrome update cadence rather than out-of-band response. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page with malicious media content and lures a victim to visit it via phishing, malvertising, or a compromised site. When Chrome's Media component processes the content, the use-after-free is triggered and attacker-controlled heap data yields arbitrary code execution inside the renderer sandbox. No public exploit is identified at time of analysis, and gaining control of the host would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Sandboxed remote code execution in Google Chrome desktop before 147.0.7727.55 stems from a use-after-free in the Media component, letting a remote attacker who lures a victim to a crafted HTML page execute arbitrary code within the renderer sandbox. Rated 8.8 (High) by CVSS despite Chromium's internal 'Medium' severity, it was reported internally by the Chrome team and is patched, but shows no public exploit identified at time of analysis and an EPSS of just 0.04% (11th percentile), consistent with the SSVC 'Exploitation: none' determination.
RemediationAI
Vendor-released patch: update Google Chrome to 147.0.7727.55 or later via the stable channel and relaunch the browser to load the new binaries; confirm through chrome://settings/help. Managed fleets should push the update through their update-management tooling and verify enrolled clients report the fixed build. There is no supported configuration-based workaround for a media-parsing use-after-free, so patching is the only reliable fix; as an interim compensating control for unpatched endpoints, restrict browsing of untrusted sites and consider enterprise policies that reduce exposure to hostile media content, accepting that this degrades usability and does not close the bug. Ensure Chromium-based browsers (Edge, Brave, Opera) and embedded Electron runtimes are updated to versions incorporating the same upstream fix. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 Use After Free in Chrome's Media subsystem, the pipeline responsible for decoding and rendering audio/video content (e.g. HTMLMediaElement, media source buffers, and codec handling). Use-after-free bugs arise when a heap object is freed while a dangling pointer still references it; an attacker who controls page content can groom the heap so the freed slot is reoccupied with attacker-controlled data, converting the stale reference into a controlled read/write and ultimately code execution. Per the CPE (cpe:2.3:a:google:chrome:*), all Chrome desktop builds prior to 147.0.7727.55 are affected. Notably, the description scopes execution to 'inside a sandbox' - the renderer process sandbox - meaning this bug alone does not yield host compromise without a separate sandbox-escape primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page (AV:N) with no privileges (PR:N) but requiring the victim to visit it (UI:R); renderer-only compromise keeps scope unchanged (S:U) with full renderer C/I/A loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions before 147.0.7727.55 contain a use-after-free vulnerability (CVE-2026-5883, CVSS 8.8) allowing attackers to execute code on employee endpoints through socially engineered HTML pages. While no active exploitation has been observed, the widespread deployment of Chrome across enterprises creates significant endpoint risk. A patch is available and should be deployed immediately.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP6 | Fixed |
Exploit-DB