EUVD-2026-66015
GHSA-q9xc-mj4q-gv66
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via social engineering with required user install step; sandbox containment yields S:U, but arbitrary code execution warrants C/I/A all High.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
AnalysisAI
Use-after-free in Google Chrome's DevTools component (all versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code inside the Chrome sandbox by distributing a crafted extension through social engineering. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact within the process scope, though exploitation is constrained by the mandatory user interaction required to install the malicious extension. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim to install a crafted Chrome extension, making social engineering a hard prerequisite - the attack cannot proceed without this user interaction (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates low attack complexity and no privilege requirement, but the mandatory user interaction (UI:R) reflects the social engineering prerequisite - the attack cannot be scripted against passive targets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a trojanized Chrome extension - disguised as a productivity tool or security add-on - and distributes it via phishing email or a fake Chrome Web Store listing, convincing a target to install it. Once installed and when the user opens DevTools (or the extension triggers a DevTools API interaction), the use-after-free is activated, allowing the attacker to execute arbitrary code within the Chrome sandbox. … |
| Remediation | The primary fix is upgrading Google Chrome to version 152.0.7977.65 or later; the vendor's Stable Channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html confirms this release resolves the issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, announce the availability of Chrome patch 152.0.7977.65 or later to all users and IT teams. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today