EUVD-2026-35242
GHSA-9mmw-r35m-g52r
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Web Apps in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Sandbox escape in Google Chrome versions prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page exploiting a use-after-free in Web Apps. Chromium rates the severity as Critical, and a vendor patch is available, though no public exploit has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a pre-existing compromise of the Chrome renderer process - this CVE is a sandbox-escape primitive, not a standalone RCE, matching the CVSS AC:H complexity rating; (2) user interaction (UI:R) - the victim must navigate to or interact with attacker-controlled HTML that reaches the Web Apps code path; (3) the victim running Chrome at a version below 149.0.7827.103. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H produces 8.3 (High) and accurately reflects the realistic prerequisites: network reachable, but high attack complexity, user interaction required (visiting a crafted page), and scope change (sandbox escape crossing trust boundaries). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first lures a user to a malicious or compromised website that triggers a separate renderer-process vulnerability (or uses a stolen renderer RCE primitive) to gain code execution inside the sandboxed Chrome tab. From that foothold, the attacker serves crafted HTML/JavaScript that drives the Web Apps subsystem into the use-after-free condition, manipulating freed object reuse to hijack control flow in the browser process and escape the sandbox onto the host. … |
| Remediation | Vendor-released patch: update Google Chrome to 149.0.7827.103 or later via the stable channel auto-update mechanism (chrome://settings/help to force a check and relaunch). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Alert IT and end users that Chrome 149.0.7827.103 or later is required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today