EUVD-2026-40534
GHSA-vgq5-582f-8hxq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs user navigation (AV:N, UI:R), no privileges (PR:N); renderer RCE gives high C/I/A but stays in the sandbox (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Forms component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser's renderer sandbox. Chromium rates the flaw High severity, CVSS 8.8, requiring only that the user visit a malicious page; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a crafted HTML page in a vulnerable Chrome build (prior to 150.0.7871.47) - the CVSS UI:R metric confirms required user interaction (navigation to the attacker's page); it is not a zero-click flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network reach, low complexity, and no privileges, but requires user interaction (visiting a page) and does not cross a privilege scope boundary - consistent with sandbox-confined renderer code execution rather than full system takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page containing malicious form markup and JavaScript that grooms the renderer heap and triggers the use-after-free in Chrome's Forms code, then lures a victim into visiting it via phishing, a malicious ad, or a compromised site. When the victim opens the page, the dangling pointer is exploited to run attacker-controlled code inside the renderer sandbox. … |
| Remediation | Vendor-released patch: Google Chrome 150.0.7871.47 - update Chrome to 150.0.7871.47 or later on all desktop platforms (the fix ships in the June 2026 Stable channel release), then fully relaunch the browser so the update takes effect, since Chrome applies updates only on restart. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Chrome desktop deployments and initiate emergency deployment of version 150.0.7871.47 (June 2026 Stable channel) or later. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today