EUVD-2026-35239
GHSA-gxhq-jrg2-rq4q
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Compositing in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Remote code execution in Google Chrome on macOS prior to version 149.0.7827.103 allows a remote attacker to exploit a use-after-free flaw in the Compositing component via a crafted HTML page. Google has rated the underlying Chromium security severity as Critical, and no public exploit identified at time of analysis, though the bug is patched in the latest stable channel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running Google Chrome on macOS at a version below 149.0.7827.103 and to load attacker-controlled HTML/JavaScript in that browser (UI:R - typically clicking a link, opening a malicious ad, or visiting a compromised site). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.5 and indicates a network-exploitable bug requiring no privileges but with high attack complexity and required user interaction - typical of browser memory corruption that needs a victim to load a malicious page and may depend on heap grooming or specific timing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious web page that triggers a specific sequence of compositor operations to free a Compositing object and then reuse the dangling reference with attacker-controlled data, achieving arbitrary code execution inside the Chrome renderer process on macOS. The victim is lured to the page via phishing, malvertising, or a watering-hole compromise; the high attack complexity implies reliable exploitation likely requires heap grooming and may be chained with a separate sandbox escape to reach the host. … |
| Remediation | Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - upgrade immediately via Chrome's built-in auto-update or by relaunching the browser, and verify the version under chrome://settings/help, per the Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Issue security notice to all macOS users; ensure patch download is available and prepare distribution mechanisms (automatic updates, MDM, etc.). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today