EUVD-2026-33091
GHSA-fvq4-f7h4-5849
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome on Windows before 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page leveraging a use-after-free in Core. The flaw is rated High by Chromium and carries CVSS 8.3, but EPSS is very low (0.03%) and no public exploit identified at time of analysis, so it is most relevant as the second stage of a multi-bug exploit chain rather than a standalone entry vector.
Technical ContextAI
The bug is a CWE-416 use-after-free in Chrome's Core component, the browser-process logic that manages cross-process coordination between the sandboxed renderer and the more privileged browser process. Use-after-free occurs when an object is freed but a dangling pointer is later dereferenced, allowing controlled memory reuse that can be shaped into a type confusion or write primitive. Because the affected code path is reachable from a compromised renderer over Chrome's Mojo/IPC surface, a renderer that has already achieved code execution (typically through a prior renderer RCE bug) can craft IPC messages or DOM/HTML interactions that trigger the freed object's reuse in the higher-privilege process, yielding sandbox escape. CPE data scopes the affected product to cpe:2.3:a:google:chrome on Windows specifically.
RemediationAI
Vendor-released patch: Google Chrome 148.0.7778.216 on the Windows stable channel - update via Chrome's built-in updater or push the new build through enterprise management (Google Update, Intune, SCCM) per the advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Verify Chromium-based downstream browsers and apply their corresponding security updates once published. Because exploitation requires a pre-existing renderer compromise plus user interaction with a crafted page, effective compensating controls while patching include enforcing Chrome's Site Isolation (already default), enabling enterprise policies that restrict navigation to untrusted sites, and deploying browser exploit-mitigation EDR sensors; note that disabling JavaScript or sandbox-related flags is not a practical mitigation and would significantly degrade browsing functionality.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today