EUVD-2026-39034Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page (AV:N), no privileges (PR:N) but requires visiting the page (UI:R); renderer-only RCE keeps scope unchanged (S:U) with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Remote code execution in Google Chrome's Blink rendering engine (InterestGroups component, part of the Privacy Sandbox/Protected Audience ad-auction API) affects all desktop versions prior to 149.0.7827.197. A crafted HTML page triggers an out-of-bounds read and write that a remote attacker can leverage to execute arbitrary code in the renderer; Chromium rates this Critical and assigns CVSS 8.8. There is no public exploit identified at time of analysis, but a vendor patch is already available, making prompt updating the priority.
Technical ContextAI
The flaw lives in Blink, Chromium's rendering engine, specifically the InterestGroups implementation that backs the Protected Audience / FLEDGE Privacy Sandbox API used for on-device advertising auctions. The root cause is CWE-125 (Out-of-bounds Read), compounded here by an accompanying out-of-bounds write per the description, indicating a memory-safety defect where attacker-influenced data lets the engine read and write beyond an allocated buffer. Because Blink parses and processes untrusted web content directly, a malformed page that exercises the InterestGroups code path can corrupt renderer-process memory. The affected product per CPE is cpe:2.3:a:google:chrome (all versions before the fixed build), and the same code is shared across Chromium-based browsers (Edge, Brave, Opera, Vivaldi), which typically require their own downstream updates.
RemediationAI
Vendor-released patch: update Google Chrome to 149.0.7827.197 or later via the Stable channel; on most installs this is automatic after relaunch, so the actionable step is to force-update through chrome://settings/help and restart the browser to apply it. Verify deployment across managed fleets via enterprise update policies and confirm the version string post-relaunch. Users of other Chromium-based browsers should apply the equivalent vendor update once published. As an interim compensating control before patching, the InterestGroups attack surface is the Privacy Sandbox / Protected Audience ad-auction feature, which can be disabled via the Ad privacy settings (chrome://settings/adPrivacy) or enterprise policy - the trade-off is loss of Privacy Sandbox functionality but reduced exposure to this specific code path; note this is not a vendor-validated mitigation and does not substitute for the patch. Refer to the official advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html.
Same weakness CWE-125 – Out-of-bounds Read
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today