EUVD-2026-35262
GHSA-37wr-36rm-9m57
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Type Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution in Google Chrome versions prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a victim to visit a crafted HTML page. The flaw stems from a type confusion bug in Chromium's Bindings layer (CWE-843), rated High severity by Chromium and CVSS 8.8 due to network-based exploitation requiring only user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must use a vulnerable Chrome desktop build (any version below 149.0.7827.103) and be induced to load attacker-controlled HTML/JavaScript - UI:R in the CVSS vector means a user action such as clicking a link, viewing a malicious ad iframe, or visiting a compromised site is required, though no authentication to the target page is needed (PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 8.8 and reflects the typical browser RCE profile: network reachable, low complexity, no privileges, but requires the victim to load a malicious page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page - delivered via phishing link, malvertising, or a watering-hole compromise of a frequently visited site - that triggers the type confusion in Chrome's Bindings layer when the victim's browser parses it. The resulting memory corruption is used to achieve arbitrary code execution inside the renderer process sandbox, providing a foothold for credential theft from the browser session, further reconnaissance, or chaining with a separate sandbox escape to compromise the host. … |
| Remediation | Vendor-released patch: Google Chrome 149.0.7827.103 - upgrade the Stable channel desktop browser to this version or later, distributing via managed update channels (Chrome Enterprise, MDM, or forced restart policies) since the embedded updater requires a relaunch to apply. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all systems running Chrome versions prior to 149.0.7827.103 through endpoint inventory tools. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today