EUVD-2026-30422
GHSA-87wp-w4rq-jfvp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with low complexity and no auth but requiring a victim visit (UI:R); execution stays in the sandbox so scope is Unchanged with full CIA impact on that process.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Remote code execution in Google Chrome's WebML component (versions prior to 148.0.7778.168) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. Chromium rates this a Critical severity heap buffer overflow (CWE-122), though the CVSS base is 8.8 because code execution is contained inside the sandbox rather than achieving a full host compromise. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.06%, 20th percentile), consistent with SSVC showing no observed exploitation.
Technical ContextAI
The flaw lives in WebML, Chrome's Web Machine Learning subsystem that exposes ML inference APIs to web content, which processes attacker-influenced data (models/tensors) parsed from a web page. The root cause is CWE-122, a heap-based buffer overflow: memory allocated on the heap is written past its bounds, corrupting adjacent heap structures and enabling control-flow hijacking. Because the parsing happens in the sandboxed renderer process, successful exploitation yields code execution inside that sandbox rather than direct kernel or OS-level access. The affected CPE is cpe:2.3:a:google:chrome, and downstream distributors Red Hat and SUSE (per the tags) repackage Chromium, extending exposure to their ecosystems.
RemediationAI
Vendor-released patch: update Google Chrome to 148.0.7778.168 or later via the Stable channel update (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); Chrome typically auto-updates, so ensure the browser is fully closed and relaunched to apply it, and verify the version under chrome://settings/help. For Red Hat and SUSE Chromium builds, apply the corresponding distribution package updates as they are published. If patching must be delayed, reduce exposure by restricting untrusted browsing and, where policy supports it, consider disabling experimental WebML/Web ML features via enterprise policy or feature flags to remove the vulnerable code path - with the trade-off that any legitimate in-browser ML functionality will stop working. Enterprise-managed fleets should push the update through their browser management/GPO tooling rather than relying solely on end-user auto-update.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today