EUVD-2026-35209
GHSA-282g-w5fh-9q49
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker hosts malicious HTML page
-
DeliveryVictim lured to page via phishing or malvertising
-
ExploitPage invokes WebCodecs API in unpatched Chrome
-
InstallTriggers use-after-free in codec object
-
C2Hijacks control flow in renderer process
-
ExecuteExecutes arbitrary code inside sandbox
-
ImpactStages follow-on sandbox escape or data theft
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target user must be running Google Chrome (or an unpatched Chromium-derivative) on a version prior to 149.0.7827.103 and must be induced to navigate to an attacker-controlled HTML page that exercises the WebCodecs API (per CVSS UI:R, user interaction is required). No authentication or prior access to the victim system is needed (PR:N), attack complexity is Low (AC:L), and exploitation works over the network (AV:N) against default Chrome configurations since WebCodecs is enabled by default. Limiting factors: code execution is confined to the renderer sandbox (S:U, scope unchanged) so reaching the underlying OS requires chaining a separate sandbox escape, and the user-interaction requirement means purely passive or wormable propagation is not viable. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction and does not change scope, with high impact across confidentiality, integrity, and availability. Chromium internally rates this 'High' (one tier below Critical), and the vendor has shipped a fix in 149.0.7827.103. There is no CISA KEV listing, no EPSS score provided in the input, and no public exploit identified at time of analysis - so this is a high-CVSS issue without confirmed active exploitation signals. The required user interaction (visiting a crafted HTML page) and the fact that code execution is confined to the sandbox both reduce real-world severity compared to a no-interaction sandbox-escape RCE, but Chrome's enormous install base and the historical pattern of WebCodecs/renderer use-after-frees being chained with sandbox escapes mean this still warrants prompt patching across managed fleets. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing JavaScript that abuses the WebCodecs API to trigger the use-after-free, then phishes or otherwise lures a Chrome user (versions before 149.0.7827.103) into visiting the page - for example via a watering-hole compromise, malvertising, or a targeted email link. When the page loads, the dangling pointer in the codec object is reused to gain attacker-controlled execution inside the Chrome renderer sandbox, giving access to the victim's tab data and a foothold from which a separate sandbox-escape bug could be chained for full host compromise. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in Google Chrome versions prior to 149.0.7827.103 allows attackers to execute arbitrary code within the browser sandbox by luring users to a malicious HTML page that triggers a use-after-free in the WebCodecs component. Chromium rates this as High severity with a CVSS score of 8.8, and while a vendor patch is available, no public exploit has been identified at time of analysis. Exploitation requires user interaction (visiting a crafted page), which moderates real-world risk somewhat but still places this in the high-priority browser-patching tier.
RemediationAI
Vendor-released patch: update Google Chrome to 149.0.7827.103 or later on the Stable channel by allowing Chrome's auto-update mechanism to run and then restarting the browser; for enterprises, push the update via your management tooling (Chrome Browser Cloud Management, Group Policy 'TargetVersionPrefix', Jamf, Intune, or equivalent) and verify rollout. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html for full details. Users of Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) should apply their respective vendor updates once those vendors merge the upstream fix. As a compensating control until patching is complete, administrators can disable the WebCodecs API for untrusted origins via enterprise policy or extension-based content blocking (trade-off: breaks video-conferencing, streaming, and other media-heavy web apps that depend on hardware-accelerated codec access), and/or enforce strict site-isolation and stricter SafeBrowsing policies to reduce the chance users reach attacker-controlled HTML pages.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebCodecs is a Chromium web platform API that exposes low-level audio and video encoder/decoder primitives to JavaScript, used for streaming, video conferencing, and media processing in the browser. The root cause is CWE-416 (Use-After-Free), a memory-safety class bug where memory is referenced after being freed - in WebCodecs this typically arises from object lifetime mismanagement between JavaScript handles and the underlying C++ codec objects. Successful exploitation of such bugs in Chromium's renderer process commonly leads to attacker-controlled code execution constrained by the sandbox, which is why the description specifically notes 'inside a sandbox' - a separate sandbox escape would be required for full host compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WebCodecs in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome contains a high-severity remote code execution vulnerability (CVSS 8.8) that could allow attackers to compromise employee systems through malicious websites, potentially leading to data theft and unauthorized system access. Because Chrome is essential to business operations and used by most employees, this vulnerability poses significant organizational risk. A vendor patch (version 149.0.7827.103) is available and must be deployed to all systems immediately.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB