EUVD-2026-89116
GHSA-8rm2-3gr2-fmm8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryServe crafted web content
-
ExploitTrigger use-after-free in renderer
-
ExecutionReclaim freed object, corrupt memory
-
ImpactExecute attacker code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled web content in a vulnerable Chrome build (before 154.0.8037.57) - this is the UI:R user-interaction gate (visiting a page or opening malicious content), with no authentication (PR:N) and no special configuration. The primary limiting factor is that the attacker must drive the user to the malicious page and, because scope is unchanged (S:U), initial code execution is confined to the renderer sandbox; achieving full system compromise would require chaining a separate sandbox-escape bug. Applying the available Chrome update fully remediates. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated use-after-free (CWE-416) in Google Chrome that requires only that a victim visit a malicious page (UI:R). Scope is unchanged (S:U), meaning impact is contained to the renderer sandbox absent a separate escape, but full C/I/A:H makes this a drive-by RCE-class memory-corruption bug typical of Chrome renderer UAFs. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is currently 'no public exploit identified at time of analysis' - not confirmed exploited. However, Chrome UAFs are a historically high-value target routinely weaponized, and a vendor patch is already available, which both confirms the bug's reality and starts the window in which n-day exploits are reverse-engineered from the fix. Note a data conflict: the input Tags include 'Information Disclosure', but the vector's I:H/A:H clearly indicate integrity and availability compromise (code execution), not mere disclosure - treat the tag as mislabeled. Net: a genuine high priority for any environment running Chrome, driven by ubiquity and low attack complexity rather than by confirmed active exploitation. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing content that triggers the use-after-free in a Chrome component, then lures a victim to visit it (UI:R) via phishing, malvertising, or a watering-hole. When the victim's browser renders the page, the freed object is reused to corrupt memory and achieve code execution in the renderer process. No public POC is identified at time of analysis, but the vendor fix enables n-day exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Sep 29, 2026
Use-after-free in Google Chrome builds prior to 154.0.8037.57 allows remote, unauthenticated attackers to corrupt memory when a victim loads attacker-controlled web content, with potential for information disclosure and code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates low-complexity, network-reachable exploitation that is gated only by user interaction, and because scope is unchanged (S:U) any initial code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor patch in Chrome 154.0.8037.57 is available.
Earlier versions of this analysis (2)
Use-after-free memory corruption in Google Chrome (stable desktop channel) affects every build below 154.0.8037.57 and lets a remote, unauthenticated attacker who convinces a victim to load attacker-controlled web content corrupt freed memory in the renderer, yielding high confidentiality, integrity, and availability impact within that process. Exploitation is gated only by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), a bar trivially cleared through phishing links, malvertising, or compromised sites; no credentials, non-default settings, or special configuration are required, so default installations are exposed. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor has shipped a fixed build and the flaw combines use-after-free and memory-corruption characteristics that historically are weaponized quickly, so it warrants prompt patching. CVSS 8.8 places it in the high-severity band.
Google Chrome stable-channel desktop releases are affected by CVE-2026-95345, but the provided intelligence contains no description, CVSS vector, or CWE, so the precise impact and exploitation prerequisites cannot be independently confirmed. Patch available per vendor advisory, and no public exploit identified at time of analysis. Because the issue is addressed in the Chrome stable channel, exposure should decline as automatic background updates propagate the fixed build.
RemediationAI
Update Google Chrome to version 154.0.8037.57 or later - vendor-released patch: 154.0.8037.57 - using the browser's built-in update mechanism (Help > About Chrome) or, on Linux, the distribution package for Chromium/Chrome from Ubuntu once it carries the fixed upstream build, then verify the reported version and restart the browser so all renderer processes reload the patched binary. Full remediation of the assessed risk is achieved by this update, per the vendor advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html and the tracking issue at https://issues.chromium.org/issues/516404074. If immediate patching is not possible, treat the browser as an untrusted-input surface: restrict browsing of untrusted or unclassified web content through enterprise URL filtering or a remote-rendering/isolation layer (trade-off: reduced usability and incomplete coverage of legitimate sites that host attacker-injected content), enforce strict site isolation and keep the renderer sandbox enabled rather than disabling it for compatibility (trade-off: some legacy plugins and local-development workflows will break), and restrict browser deployment to managed builds at the fixed version (trade-off: users on unmanaged or personally installed browsers remain exposed). Note that blocking or disabling JavaScript is not a reliable mitigation here because the malicious content is merely user-interaction-gated and other active-content vectors may still reach the vulnerable code path; monitor endpoint telemetry for repeated renderer crashes, which are a common side effect of use-after-free exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free, a memory-safety defect class in which a heap object is released while a dangling pointer to it remains reachable; a subsequent dereference reads or writes memory that may have been reallocated with attacker-influenced contents, producing memory corruption that can be steered into information disclosure or arbitrary code execution. In Chrome's multi-process architecture the vulnerable logic lives in the renderer (browser engine or JavaScript runtime), where untrusted web content is parsed and executed, and the practical exploitation path is to drive the victim's browser to a crafted page that triggers the faulty free/reuse sequence - consistent with the advisory tags for Use After Free, Memory Corruption and Information Disclosure. The specific internal component is not disclosed in the supplied EUVD/NVD data; technical tracking is at the Chromium issue tracker (issues.chromium.org/issues/516404074) and the Stable channel advisory at chromereleases.googleblog.com. The report originating from vendor:ubuntu indicates the corresponding Chromium/Chrome packages shipped in Ubuntu are also in scope for remediation. The UI:R requirement and unchanged scope mean that, absent an additional sandbox-escape vulnerability, exploitation yields code execution inside the renderer process rather than direct operating-system compromise.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable UAF triggered by visiting a malicious page (UI:R, PR:N, AC:L); renderer-contained code execution keeps scope unchanged with full C/I/A impact.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[Unknown description]
Executive ViewAI
Google Chrome versions prior to 154.0.8037.57 contain a high-severity flaw that could enable remote code execution within the browser's sandbox when a user visits a malicious website. With Chrome ubiquitous in most organizations, a successful attack could lead to sensitive data compromise or act as a launchpad for broader network intrusion. Leadership should ensure rapid patching to mitigate this risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB