EUVD-2026-70705
GHSA-wmvp-4mc4-v6jr
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H captures the renderer pre-compromise prerequisite; S:C reflects sandbox escape to host OS; UI:R requires victim to visit the crafted page; PR:N since no attacker credentials are needed.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Use-after-free in Chrome's Compositing component (versions prior to 152.0.7977.82) enables a sandbox escape when chained with a renderer-process compromise - an attacker who has already gained control of the renderer can corrupt memory in the Compositing layer and execute arbitrary code outside Chrome's sandbox boundary on the host operating system. The CVSS S:C (scope changed) metric confirms this is a privilege-escalation-across-boundary primitive, delivering full C:H/I:H/A:H impact against the underlying OS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential prerequisites: (1) the attacker must have already achieved code execution within Chrome's renderer process, typically via a separate, unrelated renderer vulnerability - this CVE does not provide the initial renderer foothold on its own; and (2) the victim must visit or be directed to a crafted HTML page that triggers the Compositing UAF condition, meaning user interaction (UI:R) is mandatory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.3 score with AC:H correctly captures the chained attack requirement - this vulnerability cannot be weaponized in isolation; a separate renderer-process exploit must be acquired and deployed first, raising the total attack cost substantially. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome to version 152.0.7977.82 or later immediately via the browser's built-in update mechanism (Menu → Help → About Google Chrome) or via enterprise deployment tooling (MSI/ADMX, Chrome Browser Cloud Management). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory Chrome deployments across the organization and prepare user communications about the mandatory patch. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today