EUVD-2026-34754
GHSA-66jg-ppmj-786h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious site
-
DeliveryDeliver crafted HTML/JS payload
-
ExploitTrigger use-after-free in Input
-
ExecutionReclaim freed object with controlled data
-
PersistEscape renderer sandbox
-
ImpactExecute code in browser-process context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must be running Google Chrome older than 149.0.7827.53 and must actively visit attacker-controlled HTML content (UI:R in the CVSS vector - required user interaction such as clicking a link, opening a malicious page, or being redirected via an ad). No authentication to the target is required (PR:N), and no special Chrome configuration or non-default feature flag is called out in the advisory - default installations are in scope. The practical limit on exploitation is that a use-after-free in Input typically yields only a partial primitive: turning it into a full sandbox escape generally requires chaining with a separate renderer exploit, which raises the bar above 'drive-by RCE' even though the CVSS reflects scope change. |
| Impact | Signals here conflict and warrant nuanced prioritization. The CVSS base of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated bug that requires user interaction (visiting a page) and crosses sandbox boundaries - classic critical-browser-bug shape. However, Chromium itself assigned severity 'Low' to the underlying issue, EPSS is only 0.03% (11th percentile), the bug is not on CISA KEV, and no public exploit has been identified. The Low Chromium rating likely reflects difficulty of reliable exploitation (UAF in Input + sandbox escape typically needs to be chained with a renderer RCE to be useful end-to-end). Practical priority: patch on the normal Chrome update cadence rather than treating as an emergency, but do not defer indefinitely - sandbox-escape primitives are valuable building blocks in exploit chains. |
| Exploit ScenarioDerived | An attacker hosts a malicious HTML page (or compromises an ad network / a legitimate site) that delivers JavaScript crafted to trigger the use-after-free in Chrome's Input handling. When a victim with a vulnerable Chrome build visits the page, the dangling Input pointer is reclaimed with attacker-controlled data and dereferenced, giving the attacker a primitive that, when chained with a renderer-side RCE, can escape the sandbox into the browser process. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to break out of the renderer sandbox via a use-after-free flaw in the Input component when a victim visits a crafted HTML page. The CVSS score of 9.6 reflects the scope change inherent to sandbox escapes, though Chromium rated the underlying severity as Low and EPSS estimates exploitation probability at only 0.03%. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 on the Stable channel - upgrade all desktop installs by allowing the auto-updater to apply the build or by forcing an update via chrome://settings/help, then restart the browser to complete activation; verify per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprises managing Chrome via policy should push the new pinned version through their MDM/GPO channel and confirm fleet compliance. For downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) and Electron-based apps, update to the vendor build that incorporates the equivalent Chromium fix. As a temporary compensating control until the update lands, restrict users to trusted sites via SafeSites/URL allowlists or enable Enhanced Safe Browsing - these reduce exposure to malicious HTML payloads but do not eliminate risk from compromised or ad-served content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-416 Use-After-Free in Chrome's Input subsystem, which handles keyboard, mouse, touch, and pointer event dispatch within Blink and the browser process. Use-after-free bugs in this surface typically arise when an Input object's lifetime is not correctly tied to its referencing handler, allowing memory to be reclaimed and re-allocated for attacker-controlled data before the dangling pointer is dereferenced. Because the CVSS vector includes S:C (scope changed), the bug enables crossing the renderer/browser trust boundary - i.e., a sandbox escape - which is consistent with the 'Input' surface being reachable across processes. Affected builds correspond to all Chrome desktop versions before 149.0.7827.53 (per the EUVD record EUVD-2026-34754).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 149.0.7827.53 contain a critical sandbox escape vulnerability allowing remote attackers to breach browser security isolation when users visit malicious websites. This directly threatens all Chrome-dependent systems across the enterprise, exposing endpoints to potential compromise and data theft, and requires emergency patching of the user base.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB