EUVD-2026-35207
GHSA-mhrm-mf55-j4p7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim loads attacker-controlled URL on Linux Chrome
-
DeliveryCrafted HTML triggers Ozone object lifecycle bug
-
ExploitUse-after-free corrupts renderer heap
-
ExecutionAttacker gains code execution in sandboxed renderer
-
ImpactOptional chain with sandbox escape for host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must run Google Chrome on Linux at a version before 149.0.7827.103 and must be induced to load attacker-controlled HTML (CVSS UI:R), so drive-by browsing, phishing links, malvertising, or compromised third-party content all qualify as delivery paths. No authentication to Chrome or any service is required (PR:N), attack complexity is Low (AC:L), and exploitation occurs over the network (AV:N) against a default Chrome build - no special browser flag, extension, or configuration toggle is called out by the advisory. Limiting factors: the bug is scoped to the Linux Ozone backend (Windows/macOS Chrome are not in the advisory text), scope is Unchanged so impact is initially contained to Chrome's renderer sandbox, and a second sandbox-escape primitive would be needed for code execution outside the browser process. |
| Impact | Signals are mixed but lean toward prioritized patching rather than emergency response. CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity, unauthenticated path requiring user interaction (visiting a page), with high impact across CIA - consistent with a typical Chrome renderer-class bug. The Chromium project rates it High severity and a patch is available, but no EPSS score or SSVC decision data was provided in the input, and the vulnerability is not listed in CISA KEV, so widespread active exploitation cannot be asserted. No public exploit identified at time of analysis; however, Chrome UAFs have historically been chained quickly after disclosure, so the realistic priority is high for Linux Chrome fleets even absent confirmed in-the-wild use. Scope is Unchanged (S:U), meaning impact is bounded by Chrome's sandbox absent a second escape bug - a meaningful limiter worth weighing against the High rating. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted HTML that exercises a freed Ozone object during rendering on a Linux Chrome user. The victim is lured to the page via phishing, a compromised ad, or a watering-hole site; on load, Chrome triggers the use-after-free and the attacker steers the resulting heap corruption toward arbitrary code execution inside the sandboxed renderer, which would then need to be chained with a sandbox escape for full system compromise. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Heap corruption in Google Chrome's Ozone component on Linux before version 149.0.7827.103 allows remote attackers to potentially achieve arbitrary code execution within the browser process when a victim visits a crafted HTML page. The flaw is a use-after-free rated High severity by Chromium, with CVSS 8.8 reflecting network-reachable exploitation requiring only minimal user interaction. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 for Linux; update affected endpoints to this version or later via the standard stable channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. For managed fleets, push the update through your Chrome enterprise policy or package manager and verify chrome://version reports 149.0.7827.103+; restart all browser processes since Chrome does not apply binary updates until relaunch. Users of Chromium-derived browsers should monitor their respective vendors for backported builds and update once available. As an interim compensating control before patching, restrict browsing on Linux workstations to trusted sites (URL allowlists via enterprise policy) and ensure site isolation is enabled (default) so that a crafted page is confined to a per-site renderer - this does not block the bug but raises the cost of a useful exploit chain; disabling JavaScript would reduce reachability but is generally too disruptive for production use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ozone is Chromium's platform abstraction layer for low-level windowing, input, and graphics on Linux (and Chrome OS), bridging the browser to backends such as X11 and Wayland. The vulnerability is a CWE-416 Use-After-Free, where an object is freed while a reference to it remains live, allowing later access to reclaimed memory and enabling heap corruption. In a renderer or browser-side Ozone path, such corruption can be steered into a controlled write or type-confusion primitive, which historically maps to sandboxed code execution in Chrome and forms the first stage of a multi-bug exploit chain.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome for Linux contains a heap corruption vulnerability (CVE-2026-11681, CVSS 8.8) enabling arbitrary code execution when users visit a malicious website; no public exploit identified at time of analysis. This poses significant risk to organizations with Linux-based user communities, as the attack is network-reachable and requires only minimal user interaction. Immediate patching is critical given the severe attack surface and widespread Chrome adoption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB