EUVD-2026-50585
GHSA-cgpw-34vx-hvv3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
DeliveryDeliver malicious V8 JavaScript payload
-
ExploitTrigger use-after-free in V8 heap
-
ExecutionHijack control flow via dangling pointer
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-controlled or compromised HTML page with malicious JavaScript in a vulnerable Chrome build (<151.0.7922.72) - the UI:R metric confirms user interaction is mandatory, so no fully unattended/wormable exploitation. The primary limiting factor is that successful code execution is confined to the renderer sandbox per the description; converting it to host compromise requires a separate sandbox-escape vulnerability. No authentication is needed (PR:N), the target must merely browse to the page, and only the pre-patch Chrome/Chromium desktop versions are affected. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects network reachability, low complexity, no privileges, but required user interaction (visiting a page) and, critically, an unchanged scope - the description explicitly states code execution occurs 'inside a sandbox,' so the raw impact overstates real-world severity until paired with a sandbox-escape bug. This is corroborated by Chromium's own rating of Medium severity. Supporting signals point to modest urgency: EPSS is only 0.21% (12th percentile), the CVE is NOT on CISA KEV, and no POC is referenced. The signals are consistent rather than conflicting: high CVSS but low EPSS, no active exploitation, and vendor-assigned Medium severity together indicate a patch-on-normal-cycle issue rather than an emergency, though V8 UAF bugs are historically valuable and can be chained, so it should not be ignored. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted JavaScript that triggers the V8 use-after-free, then lures a victim to visit it (phishing link, malvertising, or a watering-hole site). When the page's script runs, the dangling pointer is exploited to execute arbitrary code within the browser's renderer sandbox. No POC is referenced in the available data, and additional sandbox-escape chaining would be required to reach the underlying host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free memory corruption issue; Google has released a fixed stable-channel build, and there is no public exploit identified at time of analysis. Despite a CVSS of 8.8, Chromium rated the security severity Medium and EPSS is low (0.21%, 12th percentile), and the impact is constrained to code execution within the sandbox rather than full host compromise.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome staging leaves the old binary running until relaunch. Users on Chromium-based browsers should apply their vendor's corresponding update once it ships. As interim compensating controls before patching, restrict browsing of untrusted sites, and where feasible enforce Chrome's Site Isolation and 'Strict' security settings; disabling the JavaScript JIT via the enterprise policy or the '--js-flags=--jitless' / v8-disable-optimizing-compiler hardening reduces the exploitability of V8 memory-corruption bugs at a meaningful performance cost to script-heavy sites. These controls do not remove the flaw and should be treated as stopgaps until the patched version is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in V8, the C++ JavaScript and WebAssembly engine that powers Chrome and all Chromium-derived browsers. A use-after-free (CWE-416) occurs when the engine continues to reference a heap object after it has been freed, letting an attacker groom the heap so the dangling pointer resolves to attacker-controlled data, corrupting memory and hijacking control flow. Because V8 executes untrusted script from any visited web page, such bugs are directly reachable from a crafted HTML/JS payload. The affected component per CPE is cpe:2.3:a:google:chrome (all versions below the fixed build); as a V8 defect it applies to the desktop Chrome stable channel and, by extension, other Chromium-based browsers that embed the same engine version.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable via a crafted page needing only a visit (UI:R, PR:N, AC:L); scope unchanged because execution stays within the sandbox, with high C/I/A on the renderer process.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome users in your organization face a remote code execution risk from CVE-2026-17836 when visiting crafted websites. While the technical severity is high (CVSS 8.8), no public exploit is identified at time of analysis, and real-world exploitation likelihood is very low (0.2% per EPSS); impact is restricted to the browser sandbox. Patch deployment should be completed within 30 days using standard change management procedures.
Apply vendor patch: Chrome 151.0.7922.72 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB