EUVD-2026-65823
GHSA-2j76-q5hv-3cpm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryVictim visits page in vulnerable Chrome
-
ExploitAnimation component processes malicious content
-
ExecutionType confusion corrupts renderer memory
-
ImpactArbitrary code executes within Chrome sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction is required - the victim must visit a crafted HTML page in a vulnerable Chrome browser (PR:N/UI:R in CVSS vector). No authentication, special configuration, or non-default settings are needed; any default Chrome installation below version 152.0.7977.65 is vulnerable when a user browses attacker-controlled content. Exploitation is limited to code execution within the Chrome renderer sandbox (S:U); achieving OS-level compromise would require a separate sandbox escape not demonstrated in this CVE. The requirement for a user to navigate to a specific malicious page limits scalability compared to server-side vulnerabilities - phishing, malvertising, or watering-hole delivery would be required vectors. |
| Impact | The CVSS 8.8 score is driven by network delivery, low complexity, no required privileges, and high C/I/A impact (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making this technically severe. However, several signals moderate the real-world priority: EPSS is only 0.27% at the 19th percentile, indicating that exploitation probability is currently low relative to other vulnerabilities; there is no CISA KEV listing; and no public proof-of-concept has been identified. The unchanged scope (S:U) confirms that sandbox escape is not demonstrated - code execution remains confined to the renderer process, which is a meaningful containment layer. This is a genuine priority for organizations that cannot promptly patch Chrome, but the EPSS and KEV signals suggest this is not under active mass exploitation as of analysis time. The UI:R requirement also limits drive-by automation - a user must actively navigate to a malicious page. |
| Exploit ScenarioDerived | An attacker hosts a specially crafted HTML page containing malicious JavaScript or CSS animations designed to trigger the type confusion condition in Chrome's Animation component. A victim running a vulnerable Chrome version visits the page, whereupon the renderer processes the animation and confuses internal object types, causing memory corruption that an attacker can leverage to execute arbitrary code within the Chrome renderer sandbox. No public exploit code has been identified, so this scenario remains theoretical pending further public disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Type confusion in Chrome's Animation component allows remote unauthenticated attackers to potentially execute arbitrary code within the browser sandbox by luring a user to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this at the 19th percentile (0.27%), suggesting limited immediate exploitation pressure despite the high CVSS score.
RemediationAI
Update Google Chrome to version 152.0.7977.65 or later, which contains the vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. Chrome's auto-update mechanism will deliver this for most managed and consumer deployments; verify via chrome://settings/help. If immediate patching is not feasible, consider restricting access to untrusted web content via enterprise policy (e.g., URL blocklists, Safe Browsing enforcement) to reduce the attack surface - note this degrades general browsing utility. Running Chrome with enhanced sandboxing flags (--renderer-sandbox) does not prevent exploitation but limits post-exploitation reach within the renderer process.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-843 (Type Confusion) occurs when code accesses a resource using an incompatible type, typically allowing an attacker to manipulate internal memory structures in ways the runtime did not intend. In Chrome's Animation subsystem - part of the Blink rendering engine - this class of flaw commonly arises when JavaScript or CSS animations trigger internal C++ object transitions that confuse the garbage collector or object type registry, leading to use-after-free or out-of-bounds memory conditions. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions below 152.0.7977.65. Exploitation is bounded by Chrome's sandbox (S:U in the CVSS vector), meaning a successful trigger executes code within the renderer process rather than escaping to the OS directly.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via HTML page, no privileges or special config needed, user must visit page (UI:R), scope unchanged due to sandbox containment, full C/I/A within renderer.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type confusion in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A type confusion vulnerability in Google Chrome's Animation component (CVE-2026-79209, CVSS 8.8) allows remote attackers to execute arbitrary code within the browser sandbox on unpatched systems. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms; while no public exploit identified at time of analysis, any user visiting a malicious webpage could be compromised, creating substantial risk for data theft and malware delivery.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB