EUVD-2026-50787
GHSA-cjp4-vqvh-cq9p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryLoader processes malicious resource
-
ExploitTrigger use-after-free in freed object
-
ExecutionGroom heap and hijack execution
-
ImpactRun arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled web content - the CVSS UI:R and the description's 'crafted HTML page' confirm user interaction (navigating to or rendering a malicious/compromised page, including via an iframe or ad) is mandatory; there is no unauthenticated drive-by without page load. The affected build is any Chrome prior to 151.0.7922.72. A key limiting factor is that successful exploitation yields code execution only 'inside a sandbox' (S:U), so the renderer sandbox contains the impact and a full breakout requires an additional, separate sandbox-escape vulnerability not covered by this CVE. No authentication is required (PR:N). |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) reflects a network-reachable, low-complexity, unauthenticated bug that nonetheless requires user interaction (UI:R) - a victim must open a malicious page. Scope is Unchanged (S:U), consistent with the description's note that code executes 'inside a sandbox,' meaning impact is bounded absent a chained sandbox escape. Real-world urgency signals are moderate rather than acute: EPSS is only 0.35% (28th percentile), there is no CISA KEV listing, and no public exploit is identified - so this is a serious memory-corruption flaw but not currently evidence of mass exploitation. The main caveat is that Chrome's ubiquity and the reliability of UAF exploitation techniques mean browser Loader bugs are frequently weaponized over time, so prompt patching is warranted despite the low EPSS. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page (or injects it via a malvertising slot or compromised site) that triggers the use-after-free in Chrome's Loader; when a victim running a pre-151.0.7922.72 build visits the page, the freed-memory reuse corrupts heap state and yields arbitrary code execution within the renderer sandbox. To achieve host compromise the attacker would chain this with a separate sandbox-escape vulnerability. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome's Loader component before 151.0.7922.72 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page (CWE-416 use-after-free). The flaw carries a High Chromium severity and CVSS 8.8, but code execution is confined to the sandbox and requires user interaction (visiting the page); a full-system compromise would need an additional sandbox-escape bug. No public exploit identified at time of analysis, and EPSS is low at 0.35% (28th percentile).
RemediationAI
Vendor-released patch: upgrade Google Chrome to 151.0.7922.72 or later on the Stable channel; Chrome typically auto-updates, so confirm via chrome://settings/help and relaunch to apply, and use enterprise policies (e.g., forced auto-update, minimum-version enforcement) to guarantee fleet-wide rollout. Reference Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-17661. Users of Chromium-based browsers should update to the build that incorporates the corresponding fix. There is no configuration toggle that disables the vulnerable Loader path, so patching is the only reliable fix; as an interim compensating control, restrict browsing to trusted sites and deploy web/URL filtering to reduce exposure to attacker-controlled pages, accepting the usability trade-off that broad filtering can block legitimate content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a use-after-free (CWE-416) in Chromium's Loader subsystem, the component responsible for fetching and processing resources (documents, subresources) that feed the rendering pipeline. Use-after-free bugs arise when a pointer to freed heap memory is reused, letting an attacker groom the heap so the dangling reference points to attacker-controlled data, corrupting object state to redirect execution. Affected product per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build). Because the code runs in the multi-process renderer, exploitation lands inside the sandboxed renderer process rather than the privileged browser process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page (AV:N/AC:L/PR:N) requires the victim to open it (UI:R); code runs within the renderer sandbox so scope stays Unchanged with high C/I/A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome's Loader component contains a remote code execution vulnerability (CVE-2026-17661) affecting versions before 151.0.7922.72 that could allow attackers to execute code when users visit a malicious webpage. While code execution is confined to the browser sandbox and requires active user interaction, organizations with broad Chrome deployments across their user base face potential risk to sensitive data accessed through the browser and device integrity. A patch is immediately available and should be deployed urgently across the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB