EUVD-2026-50791
GHSA-fxx8-mrm7-3fhg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious JavaScript triggers V8 use-after-free
-
ExploitReclaim freed object for read/write primitive
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactRequires separate escape for host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled web content in a vulnerable Chrome build below 151.0.7922.72 - the CVSS UI:R and the description's 'crafted HTML page' confirm required user interaction (visiting/rendering the page), which is the primary limiting factor. No authentication or prior privileges are needed (PR:N) and delivery is network-based (AV:N/AC:L). A significant scope limit stated in the description is that the resulting code execution occurs 'inside a sandbox,' so this vulnerability by itself does not grant host-level control without a separate renderer sandbox escape; it also requires JavaScript/V8 execution to be enabled (the default). |
| Impact | The signals are mixed and must be weighed together rather than on CVSS alone. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) reflects a network-reachable, low-complexity, unauthenticated bug that still requires user interaction (the victim must open a page) and does not change scope. Countering the high base score, EPSS is only 0.35% (28th percentile), CISA SSVC records Exploitation: none and Automatable: no, and there is no KEV listing or public POC - so this is not a mass-exploitation event today. However, SSVC Technical Impact is 'total,' consistent with memory-corruption RCE, Chrome's ubiquity means any weaponization would have enormous reach, and V8 UAF bugs are historically prized by exploit developers. The description explicitly scopes execution to 'inside a sandbox,' meaning this alone does not yield host compromise without an additional sandbox-escape - a real limiting factor that raw CVSS does not capture. Net: patch promptly given the footprint, but current risk is prospective, not confirmed active exploitation. |
| Exploit ScenarioDerived | An attacker hosts a malicious HTML page (or injects script into a compromised or ad-served page) that drives V8 into the use-after-free, then sprays the freed slot to gain a read/write primitive and execute code within the renderer sandbox. A victim running a vulnerable Chrome build only needs to visit the page - no clicks or credentials beyond the visit. No public POC is identified at time of analysis, and full system compromise would require pairing this with a separate sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8, but there is no public exploit identified at time of analysis, EPSS is low (0.35%, 28th percentile), and CISA SSVC marks exploitation as none. Because code execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the built-in updater (Help > About Google Chrome) and relaunch to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through enterprise policy/MDM and force a browser restart, since the fix is inert until relaunch. If immediate patching is not possible, reduce exposure with URL/category filtering at the proxy to limit arbitrary web content and enable Chrome's Enhanced Safe Browsing; keep Site Isolation and the renderer sandbox enabled since this bug executes only inside the sandbox. These web-filtering controls only narrow the delivery surface and do not remove the flaw, so treat them as stopgaps until 151.0.7922.72 is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in V8, the C++ JavaScript/WebAssembly engine Chrome uses to JIT-compile and execute untrusted script from any web page. A use-after-free (CWE-416) occurs when the engine keeps referencing a heap object after it has been freed, letting an attacker who controls JavaScript reclaim that memory with attacker-controlled data and corrupt engine state - in V8 a well-known path to an arbitrary read/write primitive and ultimately code execution in the renderer. The affected component is identified by CPE cpe:2.3:a:google:chrome (all builds below the fixed version), and the corruption is reachable purely through content rendered on a malicious or compromised page.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via a crafted page with no auth (AV:N/PR:N) but needs the victim to open it (UI:R); V8 UAF yields full renderer compromise (C/I/A:H) confined to the sandbox, so scope is unchanged (S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome users across the organization running versions prior to 151.0.7922.72 face remote code execution risk when visiting malicious websites, exposing endpoints to potential compromise and data theft. This V8 JavaScript engine vulnerability (CVSS 8.8) requires only opening a crafted webpage to trigger, though a patch is immediately available from Google.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB