EUVD-2026-65855
GHSA-hjqv-2ccf-f5fg
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network vector for remote HTML delivery, AC:H for mandatory renderer pre-compromise complexity, PR:N as no external authentication is required, UI:R for page visit, S:C for sandbox escape yielding full post-escape CIA impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Audio in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Use-after-free in the Audio component of Google Chrome on Android (versions prior to 152.0.7977.65) enables sandbox escape and arbitrary code execution outside the Chrome renderer sandbox. Exploitation requires an attacker to have already compromised the renderer process and then deliver a crafted HTML page to trigger the memory corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two sequential conditions are required: the attacker must first achieve code execution within Chrome's renderer process via a separate, unrelated vulnerability (a non-trivial prerequisite not addressed by this CVE alone), and the victim must visit or be navigated to a crafted HTML page that triggers the Audio UAF (user interaction required, per UI:R in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 8.3 (High) reflects full C/I/A impact and a scope change, but several signals substantially reduce realistic urgency: AC:H captures the multi-stage nature of the attack (renderer must already be compromised before this vulnerability can be triggered), UI:R requires the victim to visit a crafted page, and EPSS sits at just 0.41% (34th percentile), indicating very low observed exploitation interest from threat intelligence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first exploits a separate renderer-level vulnerability - such as a V8 JavaScript engine bug - to gain code execution within Chrome's sandboxed renderer process on the victim's Android device. They then cause the compromised renderer to process a crafted HTML page containing malicious audio content, triggering the use-after-free in Chrome's Audio component and corrupting heap memory to redirect execution outside the sandbox. … |
| Remediation | Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store or Chrome's built-in update mechanism, per the stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify Chrome on Android installations and current version distribution across your mobile device fleet through MDM telemetry. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today