EUVD-2026-65845
GHSA-9cj9-8793-mm9m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure victim via social engineering
-
ExploitVictim's Chrome renders page
-
ExecutionTrigger use-after-free in Views
-
PersistReclaim freed memory with controlled data
-
ImpactExecute code outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively visit or load an attacker-controlled crafted HTML page (CVSS UI:R plus the description's 'leveraging social engineering'), so it is not a no-interaction drive-by against a passive target and cannot self-propagate without user action. No authentication is required (PR:N, unauthenticated remote). The victim must be running a vulnerable desktop Chrome build below 152.0.7977.65; fully patched instances are not exploitable. Reliability further depends on defeating browser-process hardening and heap unpredictability, and the required user interaction is the principal factor limiting real-world exploitation (reflected in SSVC Automatable: no). |
| Impact | The signals are notably in tension and should be weighed together rather than taken at face value. CVSS 3.1 scores this 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C, full C/I/A impact) because a sandbox escape crosses a trust boundary, yet Google's own Chromium severity rating is only Medium, EPSS is low at 0.33% (25th percentile), and CISA SSVC reports Exploitation: none and Automatable: no (mitigated by the required user interaction) while acknowledging Technical Impact: total. There is no KEV listing and no confirmed public POC. Net assessment: this is a genuine high-impact browser bug worth prompt patching, but current evidence points to no active or widespread exploitation - the CVSS 9.6 reflects worst-case potential, while EPSS, SSVC, and the vendor's Medium rating suggest real-world exploitation is presently unlikely and, if it occurs, would be targeted rather than automatable. The UI:R requirement (social engineering to visit a page) is the key limiter distinguishing this from a wormable drive-by. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page that manipulates Chrome's heap and triggers the use-after-free in Views, then socially engineers a target - via phishing email, malicious ad, or a lookalike link - into visiting it. When the victim loads the page, the freed memory is reclaimed with attacker-controlled data, potentially yielding code execution in the browser process outside the renderer sandbox. No public POC has been identified at time of analysis, and exploitation would require the victim to open the attacker's page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox-escaping remote code execution in Google Chrome (desktop) before 152.0.7977.65 stems from a use-after-free in the Views UI framework, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. The flaw carries a CVSS 9.6 with scope change, though Google rated the Chromium security severity only Medium; there is no public exploit identified at time of analysis and SSVC lists exploitation as none. A vendor patch is available in the 152.0.7977.65 Stable channel release.
RemediationAI
Vendor-released patch: 152.0.7977.65 - update Chrome to 152.0.7977.65 or later via the Stable channel and restart the browser to apply the fix (navigate to chrome://settings/help to trigger and confirm the update), per the Chrome release advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. In managed environments, push the update through your enterprise update policy and verify the deployed version fleet-wide. Until updating completes, reduce exposure by cautioning users against visiting untrusted or unsolicited links (since exploitation requires visiting a crafted page) and, where feasible, enabling stricter site isolation and blocking access to untrusted web content; note these are only partial mitigations because the trigger is ordinary HTML rendering and cannot be fully neutralized short of the patch. Chromium-based browsers (Edge, Brave, etc.) should be updated once their vendors ship the corresponding Chromium fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a CWE-416 use-after-free in Chrome's Views component, the cross-platform C++ UI toolkit Chromium uses to build browser windows, menus, dialogs, and other on-screen widgets. A use-after-free occurs when memory is freed while a dangling pointer to it remains reachable; an attacker who controls heap layout via a crafted page can reclaim that memory and steer execution. Because Views runs in the privileged browser process rather than the sandboxed renderer, a successful exploit corresponds to code execution 'outside the sandbox,' consistent with the CVSS scope-change (S:C). The affected CPE is cpe:2.3:a:google:chrome, tagged as memory corruption / UAF / RCE.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires the victim to visit it (UI:R); sandbox escape crosses a trust boundary (S:C) enabling full code execution (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop users face critical risk of arbitrary code execution outside the browser sandbox when visiting attacker-controlled webpages. By exploiting a memory flaw in Chrome's UI framework, an attacker can bypass sandbox protections and run malicious code with system-level access; no public exploit has been identified at time of analysis. Immediate patching across all organizational devices is essential to prevent compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB