EUVD-2026-65799
GHSA-6hr8-2vjg-4jp6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the victim to open it (UI:R); the Aura UAF escapes the renderer sandbox, giving scope change (S:C) and full CIA impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox-escaping remote code execution in Google Chrome (Aura component) affects all desktop builds prior to 152.0.7977.65, where a use-after-free lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape, though exploitation requires the victim to load attacker-controlled content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to load attacker-controlled web content (UI:R) - a crafted HTML page opened in a vulnerable Chrome build prior to 152.0.7977.65; there is no authentication requirement (PR:N) and no special server-side configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and should be weighed rather than read off the headline score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page (or serves it via a malvertising/compromised-site vector) and lures a victim into visiting it; the page triggers the Aura use-after-free, corrupting browser-process memory to attempt code execution outside the renderer sandbox. Low attack complexity means no special timing or environment is needed once the page is loaded, but the attack depends on the victim opening the link. … |
| Remediation | Vendor-released patch: 152.0.7977.65 - upgrade Chrome to 152.0.7977.65 or later on all desktop platforms via the Stable channel per Google's advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: assess Chrome deployment across the organization and confirm update mechanisms are functional. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today