EUVD-2026-35209
GHSA-282g-w5fh-9q49
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in WebCodecs in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution in Google Chrome versions prior to 149.0.7827.103 allows attackers to execute arbitrary code within the browser sandbox by luring users to a malicious HTML page that triggers a use-after-free in the WebCodecs component. Chromium rates this as High severity with a CVSS score of 8.8, and while a vendor patch is available, no public exploit has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Target user must be running Google Chrome (or an unpatched Chromium-derivative) on a version prior to 149.0.7827.103 and must be induced to navigate to an attacker-controlled HTML page that exercises the WebCodecs API (per CVSS UI:R, user interaction is required). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction and does not change scope, with high impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious web page containing JavaScript that abuses the WebCodecs API to trigger the use-after-free, then phishes or otherwise lures a Chrome user (versions before 149.0.7827.103) into visiting the page - for example via a watering-hole compromise, malvertising, or a targeted email link. When the page loads, the dangling pointer in the codec object is reused to gain attacker-controlled execution inside the Chrome renderer sandbox, giving access to the victim's tab data and a foothold from which a separate sandbox-escape bug could be chained for full host compromise. … |
| Remediation | Vendor-released patch: update Google Chrome to 149.0.7827.103 or later on the Stable channel by allowing Chrome's auto-update mechanism to run and then restarting the browser; for enterprises, push the update via your management tooling (Chrome Browser Cloud Management, Group Policy 'TargetVersionPrefix', Jamf, Intune, or equivalent) and verify rollout. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify Chrome deployments across the organization and initiate patching preparation; notify stakeholders of required updates. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today