EUVD-2026-35236
GHSA-2qwf-fvgv-5362
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Heap corruption in Google Chrome's Autofill component on Windows versions prior to 149.0.7827.103 allows remote attackers to potentially achieve code execution by luring users to a malicious HTML page and convincing them to perform specific UI interactions. Chromium rates the underlying flaw as Critical severity, though CVSS scores it 7.5 due to required user interaction and high attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to visit attacker-controlled HTML in Chrome for Windows prior to 149.0.7827.103 AND to perform specific UI gestures (per the description) that interact with the Autofill feature - passive page load alone is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page on an attacker-controlled or compromised domain and lures a Chrome user there via phishing, malvertising, or a watering-hole. When the victim performs the specific UI gesture required by the page (for example, focusing or selecting an Autofill suggestion in a manipulated form), the Autofill code path frees an object whose dangling pointer is then reused, corrupting the heap in the renderer. … |
| Remediation | Vendor-released patch: Google Chrome 149.0.7827.103 for Windows; update via Chrome's built-in updater (chrome://settings/help) or by deploying the patched MSI through enterprise channels, then restart all browser processes to ensure the fix is loaded. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Issue security alert to all Windows Chrome users and initiate distribution of Chrome 149.0.7827.103 or later, prioritizing staff in sensitive data or administrative roles. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today