EUVD-2026-30464
GHSA-7v7v-cf8j-p265
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; all other metrics match the confidentiality-only, user-interaction-required disclosure scenario.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Google Lens in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Use-after-free in the Google Lens component of Chrome prior to 148.0.7778.168 enables memory disclosure from a multi-stage attack chain requiring prior renderer compromise. An attacker who has already subverted the renderer process can leverage a crafted HTML page to trigger the UAF condition in Lens, reading potentially sensitive data from process memory. This is a chained exploitation scenario - not standalone remote code execution - and while CVSS scores PR:N, the renderer prerequisite substantially narrows real-world exploitability. No public exploit code or CISA KEV listing has been identified; EPSS probability sits at 0.03%.
Technical ContextAI
CWE-416 (Use After Free) describes a condition where a memory region is freed but a stale pointer to it remains reachable, allowing an attacker to read or manipulate memory after deallocation. In this instance the vulnerable code resides in Google Lens - Chrome's integrated visual search and image analysis subsystem - which processes content within the renderer process. The affected surface is the Chromium rendering engine (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) for all platforms across versions prior to 148.0.7778.168. Because Chrome's sandbox isolates the renderer from the browser process, the UAF is reachable only after an attacker has already broken out of or otherwise subverted renderer-level protections, making this a second-stage information-leak primitive rather than an initial-access vulnerability.
RemediationAI
Upgrade Google Chrome to version 148.0.7778.168 or later, as documented in the Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's auto-update mechanism will deliver this release to most endpoints automatically; administrators managing enterprise fleets should verify deployment via policy consoles and confirm the version string in chrome://version. Because the vulnerability requires an attacker to have already compromised the renderer process, environments that enforce Chrome's strict site isolation (--site-per-process, enabled by default since Chrome 67) and keep the browser itself patched reduce the likelihood of a renderer compromise serving as the prerequisite stage. No additional workarounds are warranted given patch availability; disabling Google Lens (chrome://flags) would remove the attack surface but carries usability trade-offs for end users.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today