EUVD-2026-35206
GHSA-p222-4qg4-w3mf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker hosts crafted HTML page
-
DeliveryVictim visits page in vulnerable Chrome
-
ExploitMalicious media triggers use-after-free
-
InstallHeap groomed for control
-
C2Arbitrary code executes in renderer sandbox
-
ExecuteOptional chain to sandbox escape
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must use Google Chrome on Windows at a version below 149.0.7827.103 and must visit an attacker-controlled or attacker-injected HTML page that loads the crafted media payload - this is the UI:R requirement in the CVSS vector. No authentication to Chrome or the target site is required (PR:N). Exploitation is constrained to the renderer sandbox (S:U), so full host compromise requires chaining with a separate sandbox-escape vulnerability; non-Windows Chrome builds are not named as affected in the provided data, and the bug only fires when the vulnerable Media code path is exercised by the crafted page. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H signals network-reachable exploitation with low complexity and no privileges, but requires user interaction (visiting a malicious page) and does not cross the sandbox boundary (S:U), meaning code execution is confined to the renderer sandbox unless chained with a separate sandbox-escape bug. There is no EPSS score, no SSVC decision, and no CISA KEV entry provided, and no public exploit has been identified at time of analysis - so the realistic risk today is driven by CVSS and Chromium's High severity rating rather than confirmed exploitation. Browser memory-corruption issues of this class historically attract weaponization quickly once Chromium issue tracker details become public, so the absence of KEV/EPSS data should not be read as low priority; treat it as urgent patching for any Windows Chrome deployment, while noting that sandbox containment limits worst-case impact absent a chained escape. |
| Exploit ScenarioDerived | An attacker hosts or compromises a website that serves a crafted HTML page referencing a malicious media resource designed to trigger the use-after-free in Chrome's Media component. When a Windows user with a pre-149.0.7827.103 Chrome browser visits the page (or loads it via a malvertising iframe), the freed media object is reallocated under attacker control, yielding arbitrary code execution inside the renderer sandbox; the attacker would typically chain this with a separate sandbox-escape to fully compromise the host. No public exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in Google Chrome on Windows prior to 149.0.7827.103 allows attackers to run arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page, triggering a use-after-free condition in the Media component. The flaw carries a CVSS 8.8 (High) rating and is tagged by Chromium as High severity. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Update Google Chrome on Windows to version 149.0.7827.103 or later as released in the Stable Channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html); this is the vendor-released patch and is the primary fix. Enterprises managing Chrome via Group Policy or Chrome Browser Cloud Management should push the update through their MDM/policy channel and verify rollout, since Chrome's auto-update can be delayed by enterprise pinning. As a compensating control until patching completes, restrict browsing to trusted sites via SafeSearch/SmartScreen or proxy-based URL filtering to reduce drive-by exposure, enable Chrome's Site Isolation (default on) so the renderer compromise stays partitioned per origin, and consider temporarily disabling autoplay or media-heavy site categories - the trade-off is broken video/audio on legitimate sites. Do not rely on the renderer sandbox alone as mitigation since a chained sandbox-escape would defeat it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's Media component, which handles audio/video decoding, playback pipelines, and related media stream APIs exposed to web content. The root cause is CWE-416 (Use After Free), a memory-safety class where an object is referenced after its backing memory has been released, allowing an attacker who controls the freed-then-reallocated memory to corrupt program state and hijack control flow. Affected CPE coverage targets Google Chrome on the Windows platform specifically, per the advisory; renderer-process media handling is a historically rich exploit surface because media format parsers and pipeline state machines run with attacker-influenced lifetime semantics.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Windows users running Google Chrome prior to version 149.0.7827.103 are vulnerable to remote code execution through malicious webpages, putting corporate systems and data at risk. While no public exploits have been identified at time of analysis, vendor patches are available and should be deployed immediately to eliminate this attack surface.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB