EUVD-2026-35261
GHSA-mxr8-43v7-9g35
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Views in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free in the Views component, triggered through a crafted HTML page. Google rates this Chromium security severity High and a vendor patch is available; no public exploit identified at time of analysis and the bug is not currently listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions: the victim must run Google Chrome on Windows at a version below 149.0.7827.103; the attacker must already have achieved code execution in the renderer process via a separate vulnerability (the CVE explicitly states the attacker has compromised the renderer); and the victim must visit or be navigated to a crafted HTML page (UI:R in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H yields 8.3 and reflects a chained-exploit posture: network reachable, no privileges required, but high attack complexity, user interaction (visiting a malicious page), and a scope change consistent with crossing the sandbox boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first delivers a separate renderer-RCE exploit through a malicious or compromised website that the victim visits in Chrome on Windows. With code execution inside the sandboxed renderer, the attacker serves crafted HTML that drives the browser process's Views code into the use-after-free condition, reclaims the freed object with attacker-controlled data, and pivots to code execution in the unsandboxed browser process - yielding full user-level access to the workstation. … |
| Remediation | Upgrade Google Chrome on Windows to 149.0.7827.103 or later, which is the vendor-released patched version per the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html; in managed environments confirm that Chrome's auto-update has rolled out and force-update endpoints that are pinned or offline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory Chrome versions across Windows systems using endpoint management and identify users on versions prior to 149.0.7827.103. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today