EUVD-2026-65968
GHSA-vj9q-645h-c259
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure victim to open it
-
ExploitTrigger Aura use-after-free
-
ExecutionCorrupt reallocated object memory
-
PersistExecute code outside sandbox
-
ImpactFull host process compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled web content in a vulnerable Chrome build (prior to 152.0.7977.65) - the CVSS UI:R and the description's 'crafted HTML page' make user interaction (visiting/rendering the page) a hard prerequisite; there is no drive-by-without-interaction path, which is also why SSVC marks Automatable:no. No authentication is required (PR:N) and default configurations are affected, so any standard Chrome install rendering the malicious page is at risk. The practical limiting factors are: the user-interaction requirement, the need to reach a not-yet-patched build, and the inherent difficulty of grooming the heap to reliably win the use-after-free - no special non-default feature or platform setting is needed beyond running the affected Chrome version. |
| Impact | The signals are mostly consistent and point to a serious but not-yet-exploited flaw. CVSS 3.1 is 9.6 with AV:N/AC:L/PR:N/UI:R/S:C and total C/I/A impact, reflecting an unauthenticated, low-complexity, network-delivered sandbox escape that only requires the victim to view a page. SSVC tempers urgency: Exploitation is 'none' (no observed exploitation), Automatable is 'no' (user interaction breaks drive-by automation), while Technical Impact is 'total' (full compromise if triggered). EPSS agrees with the SSVC exploitation call - 0.46% at the 38th percentile suggests no imminent mass exploitation, and this CVE is not on CISA KEV. The takeaway: this is a genuine priority because of the total-impact sandbox escape in ubiquitous software, but the required user interaction and absence of a public exploit mean it is urgent-patch rather than drop-everything-emergency; any organization running Chrome at scale should still roll the update quickly. Note one caveat: CVSS AC:L versus a real-world UAF that typically needs a heap-grooming primitive means practical exploit development is likely harder than AC:L implies - verify against the vendor bug (issues.chromium.org/517518019) if deeper detail is needed. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page (or injects it via a malicious ad/compromised site) and lures a victim on an unpatched Chrome build to open it. The page triggers the Aura use-after-free, corrupts memory, and executes attacker code outside the renderer sandbox, giving control of the browser process on the host. AV:N with UI:R means delivery is trivial but hinges on the victim visiting the page; no public exploit is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Remote code execution in Google Chrome desktop before 152.0.7977.65 lets a remote attacker escape the renderer sandbox and run arbitrary code on the host after a victim opens a crafted HTML page. The flaw is a use-after-free in Aura, Chromium's UI/windowing layer, and Google rates its Chromium security severity as Critical (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis and EPSS is low (0.46%, 38th percentile), but the sandbox-escape impact makes it a high-priority patch.
RemediationAI
Vendor-released patch: 152.0.7977.65 - update Google Chrome to 152.0.7977.65 or later via the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html), then fully restart the browser so the running process picks up the new build. In managed fleets, push the update through your enterprise policy/management channel and use the relaunch-enforcement policy to guarantee the restart. As an interim compensating control before deployment, reduce exposure to untrusted web content (restrict browsing, enforce SafeSearch/URL filtering) since exploitation requires the user to load a malicious page; be aware this only lowers likelihood and does not remove the flaw. Chromium-based browsers should be updated to whatever version their vendor ships incorporating this fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Aura is Chromium's cross-platform abstraction for windows, input events, and compositing surfaces that underpins Chrome's desktop UI. The root cause is CWE-416 (use-after-free): an object in Aura is freed while a dangling reference remains reachable, and an attacker who controls page content can reallocate that memory and cause the stale pointer to be dereferenced, yielding attacker-controlled execution. Because Aura runs in a higher-privileged browser/UI context rather than the restricted renderer, corrupting it enables code execution 'outside the sandbox,' which is why CVSS marks a scope change (S:C). The single affected CPE is cpe:2.3:a:google:chrome:*, i.e. the Chrome desktop application across platforms prior to the fixed build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered via a crafted page with no auth (AV:N/PR:N) but requiring the victim to load it (UI:R); the sandbox escape crosses a trust boundary (S:C) with full code execution (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome users face a critical sandbox-escape vulnerability (CVE-2026-79052) that allows attackers to gain full system access by hosting a malicious website; no user interaction beyond visiting the site is required. The vulnerability affects all Chrome versions before 152.0.7977.65 and could enable complete endpoint compromise across the organization. A vendor patch is immediately available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB