EUVD-2026-65761
GHSA-55gr-f7m4-mrqx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure victim to load page
-
ExploitTrigger use-after-free in Aura
-
ExecutionReclaim freed memory, hijack control flow
-
PersistExecute code outside sandbox
-
ImpactFull host compromise as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (before 152.0.7977.65) - the CVSS UI:R and the description's 'crafted HTML page' confirm user interaction (visiting/rendering a page) is the trigger. No authentication or prior privileges are needed (PR:N), and it works against default Chrome configurations because Aura is a standard desktop component; there is no special feature flag or non-default setting to enable. Limiting factors: the attacker must get the victim to navigate to or render the malicious content, exploitation is not currently assessed as automatable (SSVC Automatable: no), and only desktop builds using Aura are in scope. The distinguishing severity factor is that the bug is 'outside the sandbox', so no separate escape chain is required. |
| Impact | The signals are mixed but lean toward high-priority patching. CVSS 3.1 is 9.6 with AV:N/AC:L/PR:N/UI:R and S:C - network-reachable, no privileges, only user interaction (visiting a page) required, and a scope change reflecting the sandbox escape, with full C/I/A impact. SSVC tempers this: exploitation is currently assessed as 'none' (no observed or public exploitation) and 'Automatable: no', though technical impact is 'total'. EPSS agrees the near-term mass-exploitation odds are low (0.33%). It is NOT on CISA KEV, and no POC is referenced, so this is a critical-severity but not-yet-exploited issue. However, browser sandbox escapes are historically high-value targets that get weaponized after patch disclosure, so the low EPSS should be read as 'not yet' rather than 'not serious'; any organization running Chrome at scale should treat this as urgent-tier patching despite the currently quiet exploitation telemetry. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page (or injects it via a malicious ad or compromised site) that triggers the Aura use-after-free when rendered. A victim simply visiting the page allows the attacker to corrupt freed memory and execute code outside the Chrome sandbox, gaining control of the host with the user's privileges. No public exploit is identified at time of analysis, but the required user interaction is minimal (a single page visit). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox-escaping remote code execution in Google Chrome (desktop, versions before 152.0.7977.65) stems from a use-after-free in Aura, Chromium's UI/windowing framework. A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code outside the browser sandbox, giving full control of the host process rather than just the renderer. Google rates the Chromium severity Critical; there is no public exploit identified at time of analysis, and EPSS exploitation probability is currently low (0.33%, 25th percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 152.0.7977.65 or later on all desktop platforms; the fix is delivered through the Stable channel update described in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html). Force a browser restart after update so the new binary loads, and in managed fleets push the version via GPO/MDM/Chrome Browser Cloud Management rather than relying on background auto-update timing. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites, enabling enhanced Site Isolation/Safe Browsing, and using web filtering to block untrusted HTML content until the update lands; note these are only partial mitigations because exploitation requires nothing more than rendering a crafted page. Downstream Chromium browsers should be updated to whichever release incorporates the corresponding Aura fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Aura is Chromium's platform-abstraction layer for windows, input events, and compositing surfaces on desktop Chrome. The root cause is CWE-416 (use-after-free): an object in Aura is freed while a dangling reference remains reachable, and subsequent reuse of that freed memory lets an attacker control object state or the vtable/callback path, leading to controlled execution. Critically, because the flaw lives in Aura - a browser/UI-side component rather than the site-isolated renderer - successful exploitation runs 'outside the sandbox', meaning it does not require a separate sandbox-escape primitive. The affected CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build), spanning the Windows, macOS, and Linux desktop channels that ship Aura.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs only a victim visit (UI:R, PR:N, AC:L); sandbox escape justifies scope change (S:C) with full C/I/A on the host.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome desktop versions before 152.0.7977.65 contain a critical sandbox-escape vulnerability (CVE-2026-79200) that enables remote code execution and complete system compromise when users visit a malicious webpage. This affects all Chrome users in your organization; while no public exploit code has been identified at this time, the vulnerability poses significant organizational risk requiring urgent patching. A vendor patch is available and should be deployed immediately.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB