EUVD-2026-66015
GHSA-q9xc-mj4q-gv66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Chrome extension
-
DeliveryDistribute via phishing or fake listing
-
ExploitVictim installs extension
-
ExecutionExtension interacts with DevTools APIs
-
PersistTrigger use-after-free in DevTools
-
ImpactExecute arbitrary code within Chrome sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to install a crafted Chrome extension, making social engineering a hard prerequisite - the attack cannot proceed without this user interaction (UI:R per CVSS). The use-after-free is triggered through the DevTools subsystem, meaning either the user or the extension itself must interact with DevTools APIs after installation; passive browsing without DevTools involvement is likely insufficient. Code execution is confined to the Chrome sandbox (S:U), meaning an attacker cannot directly reach the underlying OS without a separate, chained sandbox escape. The attack is not automatable per SSVC, as each attempt requires individually deceiving a user into installing the malicious extension. Chrome's Safe Browsing and the Web Store review process provide partial mitigations against broad distribution. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates low attack complexity and no privilege requirement, but the mandatory user interaction (UI:R) reflects the social engineering prerequisite - the attack cannot be scripted against passive targets. Scope unchanged (S:U) confirms that exploitation is sandboxed within the Chrome process, meaningfully bounding impact compared to a full OS compromise. SSVC independently rates exploitation as 'none' and automatable as 'no,' corroborating that mass exploitation is not feasible. No EPSS data was supplied in the input, so exploitation probability cannot be quantified numerically. The absence of a CISA KEV listing and no identified public exploit code further support treating this as a patch-cycle priority rather than an emergency break-fix, despite the high CVSS score. |
| Exploit ScenarioDerived | An attacker publishes a trojanized Chrome extension - disguised as a productivity tool or security add-on - and distributes it via phishing email or a fake Chrome Web Store listing, convincing a target to install it. Once installed and when the user opens DevTools (or the extension triggers a DevTools API interaction), the use-after-free is activated, allowing the attacker to execute arbitrary code within the Chrome sandbox. No public exploit code has been identified at time of analysis, so weaponization currently requires independent research by the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Use-after-free in Google Chrome's DevTools component (all versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code inside the Chrome sandbox by distributing a crafted extension through social engineering. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact within the process scope, though exploitation is constrained by the mandatory user interaction required to install the malicious extension. No public exploit code exists and SSVC rates active exploitation as none at time of analysis, placing real-world urgency below what the raw score implies.
RemediationAI
The primary fix is upgrading Google Chrome to version 152.0.7977.65 or later; the vendor's Stable Channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html confirms this release resolves the issue. As a compensating control while patching is underway, enterprise administrators can enforce extension allowlists via Chrome's managed browser policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist), preventing users from installing unapproved extensions and directly blocking the social engineering delivery vector - the trade-off is additional administrative overhead for allow-listing legitimate extensions. Disabling DevTools entirely via enterprise policy (DeveloperToolsAvailability=2) eliminates the vulnerable surface but will break developer and support workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free condition (CWE-416) in Chrome's DevTools subsystem - the built-in browser debugging interface. Use-after-free flaws arise when heap-allocated memory is released but a dangling pointer remains accessible; an attacker who can influence memory layout (here, through a crafted extension's interaction with DevTools) may reclaim that memory region and redirect code execution. The affected product is Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) across all desktop platforms for versions below 152.0.7977.65. Extensions interact with DevTools APIs, providing a controlled surface through which the use-after-free can be triggered deterministically once an extension is installed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via social engineering with required user install step; sandbox containment yields S:U, but arbitrary code execution warrants C/I/A all High.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
2DescriptionCVE.org
Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome users across the organization are vulnerable to code execution through malicious extensions in versions prior to 152.0.7977.65; a patch is immediately available. Leadership should prioritize deployment because Chrome is widely used by personnel with access to sensitive systems, though exploitation likelihood is moderated by the social engineering requirement.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB