EUVD-2026-30431
GHSA-x28c-6463-7xg5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage invokes WebShare API
-
ExploitVictim performs specific UI gesture
-
ExecutionTrigger object lifecycle flaw (CWE-664)
-
PersistCorrupt memory in browser
-
ImpactExecute arbitrary code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource lifecycle control
|
| Exploitation Conditions | Exploitation requires the victim to be running Google Chrome on macOS at a version below 148.0.7778.168 and to visit an attacker-controlled HTML page that invokes the WebShare (navigator.share) feature. Critically, the attack does not fire automatically: per CVSS UI:R and the description, the user must be convinced to perform specific UI gestures interacting with the WebShare/native share flow, so exploitation is gated on social engineering and active user cooperation. No authentication or elevated privileges are needed (PR:N, unauthenticated per the CVSS vector). Limiting factors: the platform is restricted to macOS, the required 'specific UI gestures' are non-trivial and reduce automatability (SSVC Automatable: no), and only pre-148.0.7778.168 versions are vulnerable. |
| Impact | Signals are mixed and should be weighed together. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Chromium's Critical label indicate high potential impact - full compromise of confidentiality, integrity, and availability with no privileges required - but the vector explicitly requires user interaction (UI:R), and the description narrows this further to 'specific UI gestures,' which meaningfully raises the practical bar. Countering the high CVSS, EPSS is only 0.07% (22nd percentile), and CISA's SSVC framework rates Exploitation as none and Automatable as no, while acknowledging Technical Impact as total. There is no KEV listing and no public exploit identified at time of analysis. Net: this is a genuinely severe code-execution bug worth prompt patching, but current real-world exploitation risk is low and non-automatable - prioritize via normal Chrome auto-update cadence rather than emergency response, absent new exploit intelligence. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a macOS Chrome user to it via a phishing link or malicious ad. The page invokes the WebShare API and manipulates page content so that when the victim performs the specific UI gesture (e.g., clicking through the share prompt), the object lifecycle bug is triggered, corrupting memory to achieve arbitrary code execution in the renderer. No public exploit is identified at time of analysis, and success depends on the victim completing the required interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Remote code execution in Google Chrome on macOS (versions prior to 148.0.7778.168) stems from an object lifecycle flaw in the WebShare API, allowing a remote attacker to run arbitrary code within the browser process after luring a victim to a crafted HTML page and getting them to perform specific UI gestures. Rated Critical by Chromium and reported internally by the Chrome team, a vendor patch is available; there is no public exploit identified at time of analysis, and the EPSS probability is very low (0.07%). CISA SSVC currently rates exploitation as none with total technical impact.
RemediationAI
Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on macOS, per the Chrome Stable channel advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); most installations receive this automatically, so verify via chrome://settings/help and relaunch to apply. Red Hat and SUSE users should pull the corresponding updated Chrome package from their distribution channels. As an interim compensating control until the update is applied, restrict or disable the WebShare capability - for example via enterprise policy or by discouraging use of untrusted pages that trigger the OS share sheet - accepting the trade-off that the navigator.share() feature will be unavailable to legitimate sites; broader browsing restrictions and user awareness of not performing unexpected share/UI gestures on untrusted pages further reduce exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Chrome's WebShare implementation, the browser feature backing the navigator.share() Web API that lets web pages invoke the native OS share sheet on platforms like macOS. CWE-664 (Improper Control of a Resource Through its Lifetime) classifies the root cause as an object lifecycle error - typically a use-after-free or premature/dangling object reference where an object is used after being freed or before proper initialization. Because WebShare bridges JavaScript-triggered actions to native macOS share UI, a mismatch between the lifetime of the C++ backing objects and the asynchronous, user-driven share dialog can leave a dangling reference an attacker can groom. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped specifically to the macOS build per the description.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page (AV:N) with no privileges (PR:N) but requires specific victim UI gestures (UI:R); memory-corruption RCE yields high C/I/A within the browser process (S:U).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome on macOS (versions prior to 148.0.7778.168) contains a remote code execution vulnerability in the WebShare API that could allow attackers to compromise organizational systems through crafted webpages and user interaction. While no public exploits currently exist and real-world attack probability is very low (EPSS 0.1%), successful exploitation would grant attackers complete access to the browser process and potentially sensitive organizational data. Immediate patching is critical to eliminate this attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Vendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Exploit-DB