EUVD-2026-35262
GHSA-37wr-36rm-9m57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryLure victim via phishing or malvertising
-
ExploitVictim's Chrome parses malicious content
-
ExecutionType confusion triggered in Bindings layer
-
PersistMemory corruption yields code execution in renderer sandbox
-
ImpactSteal session data or chain sandbox escape
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must use a vulnerable Chrome desktop build (any version below 149.0.7827.103) and be induced to load attacker-controlled HTML/JavaScript - UI:R in the CVSS vector means a user action such as clicking a link, viewing a malicious ad iframe, or visiting a compromised site is required, though no authentication to the target page is needed (PR:N). Exploitation is limited by Chrome's renderer sandbox: successful triggering of the type confusion yields code execution inside the sandboxed renderer process, so reaching the host OS requires a separate sandbox-escape vulnerability. Site Isolation (enabled by default since Chrome 67) further constrains cross-origin impact to the originating site's renderer. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 8.8 and reflects the typical browser RCE profile: network reachable, low complexity, no privileges, but requires the victim to load a malicious page. KEV status is not asserted in the provided data, no public exploit is identified, and no EPSS score was supplied - so signals point to a serious latent risk rather than confirmed active exploitation. Two factors elevate real-world priority: Chrome is the dominant browser making any RCE a broad target, and Chromium type confusion bugs in Bindings/V8 have a strong historical track record of being weaponized into in-the-wild attacks once details surface. A mitigating factor is that the scope is unchanged (S:U) and execution is bounded by the renderer sandbox, so a separate sandbox-escape chain would be required for full host compromise - this should be treated as a critical patch-now item regardless. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page - delivered via phishing link, malvertising, or a watering-hole compromise of a frequently visited site - that triggers the type confusion in Chrome's Bindings layer when the victim's browser parses it. The resulting memory corruption is used to achieve arbitrary code execution inside the renderer process sandbox, providing a foothold for credential theft from the browser session, further reconnaissance, or chaining with a separate sandbox escape to compromise the host. No public exploit identified at time of analysis, but the bug class is well understood and historically reproduced quickly from patch diffs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in Google Chrome versions prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a victim to visit a crafted HTML page. The flaw stems from a type confusion bug in Chromium's Bindings layer (CWE-843), rated High severity by Chromium and CVSS 8.8 due to network-based exploitation requiring only user interaction. No public exploit identified at time of analysis and EPSS data was not provided, but Chromium V8/bindings issues historically attract exploit development.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 - upgrade the Stable channel desktop browser to this version or later, distributing via managed update channels (Chrome Enterprise, MDM, or forced restart policies) since the embedded updater requires a relaunch to apply. Confirm fixed builds via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and verify via chrome://settings/help on endpoints. As no Chrome-side workaround exists for a Bindings type-confusion bug, compensating controls until patching completes include enforcing site isolation (already default), enabling Enhanced Safe Browsing to block known malicious pages with the trade-off of additional telemetry to Google, restricting browsing to allow-listed business sites via proxy or DNS filtering at the cost of user productivity friction, and ensuring host EDR is configured to alert on anomalous child processes spawned by chrome.exe. For Chromium derivatives (Edge, Brave, Electron apps), apply the corresponding vendor update once published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's Bindings subsystem, the boundary layer that translates between JavaScript objects and underlying C++ Blink/V8 implementations of Web APIs and DOM interfaces. CWE-843 (Access of Resource Using Incompatible Type) means the code accesses a memory object assuming one type while it is actually another, which in a C++ engine like Blink leads to attacker-controlled vtable, field offset, or pointer dereference primitives. Exploitation typically yields read/write within the renderer process address space, which can be chained into arbitrary code execution constrained to the renderer sandbox. The affected product per the Chromium release notes is the Stable channel of Chrome on desktop platforms, with the fix landing in 149.0.7827.103.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Type Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 149.0.7827.103 contain a remote code execution vulnerability in the Bindings layer that allows attackers to execute arbitrary code within the renderer sandbox when users visit a malicious webpage. Any employee using affected Chrome versions risks credential theft, malware installation, or lateral network movement from a compromised browser process, as exploitation requires only user interaction and no technical sophistication.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB