EUVD-2026-40713
GHSA-4pvr-rcq6-xfr4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via web page (AV:N) but requires specific UI gestures beyond a click, raising complexity (AC:H) and needing user interaction (UI:R); renderer compromise yields high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Heap corruption in Google Chrome's Views UI framework on macOS (versions before 150.0.7871.47) lets a remote attacker who lures a victim to a crafted HTML page and coaxes them into specific UI gestures trigger a use-after-free, potentially achieving code execution in the renderer. Google rates the Chromium severity as Low, but the NVD CVSS is 8.8 (High), and no public exploit has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running Google Chrome on macOS at a version below 150.0.7871.47, to visit an attacker-controlled crafted HTML page, AND - per the description - to 'engage in specific UI gestures.' This required user interaction (matching CVSS UI:R) is the key limiting factor: a passive page load is not sufficient, so the attacker must socially engineer a particular interaction, which substantially lowers real-world exploitability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page and uses phishing or a malvertising link to draw a macOS Chrome user to it; the page manipulates the Views UI so that when the user performs a particular interaction (e.g., a specific click/drag or menu gesture), the use-after-free fires and corrupts the heap. With sufficient control over memory layout the attacker could attempt renderer-level code execution, though no public proof-of-concept is currently known and reliable exploitation would be non-trivial. |
| Remediation | Vendor-released patch: 150.0.7871.47 - upgrade Google Chrome on macOS to 150.0.7871.47 or later via the Stable channel; most installs auto-update, so verify the version under chrome://settings/help and relaunch to apply. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory Chrome versions deployed on macOS systems and assess patch deployment readiness. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today