EUVD-2026-35220
GHSA-qhww-xqqg-m6hv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious site
-
DeliveryCompromise renderer via separate bug
-
ExploitRegister crafted ServiceWorker
-
ExecutionTrigger use-after-free in ServiceWorker
-
PersistGain memory corruption primitive
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have already compromised the Chrome renderer process (typically via a separate renderer bug) before this flaw can be triggered, and the victim must interact by loading a crafted HTML page that registers/manipulates a malicious ServiceWorker. Limiting factors: ServiceWorker registration requires a secure context (HTTPS or localhost), Chrome's site isolation confines the resulting code execution to the compromised renderer's origin, the CVSS High attack complexity reflects timing/heap-grooming requirements typical of use-after-free exploitation, and successful execution remains inside the renderer sandbox - a separate sandbox-escape vulnerability is required to reach host-level code execution. Affects Chrome versions before 149.0.7827.103 only. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.5 (High), reflecting network reach but tempered by High attack complexity and required user interaction. Critically, the description states the attacker must have ALREADY compromised the renderer process, which is a stronger precondition than the PR:N field captures - the vector treats that prior compromise as part of complexity rather than privileges. The bug is not in the CISA KEV catalog, no public exploit has been identified at time of analysis, and EPSS data was not provided. Real-world risk is moderate: this is a useful sandbox-internal primitive for chained renderer exploits typical of Chrome n-day work, but it is not itself a one-click drive-by RCE and does not by itself break out of the sandbox. Priority is standard browser-patch cadence rather than emergency unless paired with a known sandbox-escape bug. |
| Exploit ScenarioDerived | An attacker first achieves code execution in a Chrome renderer process via a separate vulnerability (for example a V8 type-confusion bug) on a victim who visits an attacker-controlled site. From that foothold, attacker-supplied JavaScript on the crafted HTML page registers and manipulates a ServiceWorker to trigger the use-after-free, gaining a stable memory-corruption primitive used to execute arbitrary code still inside the renderer sandbox - a typical stepping stone toward a follow-on sandbox-escape exploit. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Sandboxed remote code execution in Google Chrome versions prior to 149.0.7827.103 allows attackers who have already compromised the renderer process to execute arbitrary code via a crafted HTML page that triggers a use-after-free in the ServiceWorker component. Rated High severity by Chromium with a CVSS 7.5, the flaw requires user interaction (visiting a malicious page) and a pre-existing renderer compromise, and no public exploit has been identified at time of analysis. The vendor has released a patched Stable channel update.
RemediationAI
Update Google Chrome to 149.0.7827.103 or later via the Stable channel; the patch is available per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and tracked in the upstream issue https://issues.chromium.org/issues/517705966. For managed fleets, force an update via enterprise policy and restart browsers to apply the fix, as Chrome updates only take effect after a relaunch. If patching must be delayed, compensating controls include disabling ServiceWorker registration via the DefaultSensorsSetting / URL-blocklisted origins enterprise policies for high-risk sites (trade-off: breaks offline PWAs and push notifications), restricting browsing to trusted sites via site isolation and content filtering, and ensuring strict site isolation is enabled (already default) so a compromised renderer is confined to one origin. Users of Chromium-based browsers (Edge, Brave, Opera) should also upgrade once their vendor ships a rebased build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Chrome's ServiceWorker implementation, the browser subsystem that runs JavaScript-based background workers to intercept network requests, drive push notifications, and support offline web apps. The root cause is CWE-416 (Use After Free): a ServiceWorker object is freed but a dangling pointer is later dereferenced, allowing an attacker to manipulate the freed memory region to corrupt control-flow or object state. Because ServiceWorkers run in the renderer process, exploitation of this bug yields code execution inside the renderer sandbox rather than at the browser-broker privilege level, meaning it typically functions as one stage of a multi-bug exploit chain rather than a full sandbox escape on its own.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 149.0.7827.103 contain a high-severity vulnerability (CVE-2026-11694) enabling arbitrary code execution within compromised browser processes. All organizational Chrome users are potentially at risk; while current exploitation requires a pre-existing renderer compromise and no public exploits have been identified, immediate patching closes this escalation vector for attackers. Failure to patch leaves the organization exposed to secondary compromise attacks in advanced threat scenarios.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB