EUVD-2026-50811
GHSA-f342-mcrf-wv9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure victim to visit in vulnerable Chrome
-
ExploitTrigger Autofill use-after-free
-
ExecutionGroom heap and hijack freed object
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled HTML in a vulnerable Chrome build (before 151.0.7922.72) - the CVSS UI:R confirms user interaction (navigating to or rendering the crafted page) is mandatory; there is no drive-by-with-zero-interaction path from the available data. No authentication or privileges are needed (PR:N), and the attack works against default configurations because Autofill is an on-by-default feature, though triggering the bug depends on the Autofill code path being reachable during page rendering. The key limiting factors are: required user interaction, and scope-unchanged execution confined to the renderer sandbox (S:U), so a standalone exploit yields sandboxed code execution rather than OS-level compromise without an additional escape. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) reflects network reachability, low complexity, no privileges, but required user interaction and an unchanged scope, meaning the compromise stays within the sandboxed renderer. Signals diverge on urgency: severity is High and impact is full C/I/A, yet EPSS is only 0.35% (28th percentile), it is not on CISA KEV, and no POC is known - so this is a real but not emergency-grade priority. There is no SSVC record provided; inferring from the data, exploitation is 'none' observed, automatable is likely 'no' (requires victim navigation to a crafted page), and technical impact is 'total' for the renderer process. The scope-unchanged rating is important: absent a chained sandbox escape, an attacker gains renderer-context code execution, not host takeover, which tempers real-world impact relative to the raw 8.8. Given Chrome's ubiquity and auto-update cadence, the practical risk window is short but the affected footprint is enormous, so prompt patching is warranted. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects one via a compromised ad/iframe) that programmatically manipulates form fields to trigger the Autofill use-after-free and grooms the renderer heap. When a victim running a pre-151.0.7922.72 Chrome visits the page, the dangling pointer is dereferenced and attacker-controlled code executes inside the renderer sandbox. No public POC is currently identified, and full host compromise would require chaining a separate sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Autofill component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched browser bug not yet weaponized.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel; verify via chrome://settings/help which forces an update check and relaunch. In managed fleets, ensure Chrome auto-update is enabled and push the release through your management console (GPO/Jamf/Intune) rather than relying on user relaunch, then confirm the running version across endpoints. As an interim compensating control before update rollout completes, disabling Autofill (chrome://settings/autofill - turn off addresses, payment methods, and password autofill) reduces exposure to the vulnerable code path, at the cost of user convenience and re-entry of form data; restricting browsing to trusted sites and pushing the update as high priority further limits the window. Users of Chromium-based browsers should apply their vendor's build incorporating the equivalent Chromium fix. Advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Chrome's Autofill subsystem, the browser feature that stores and injects saved form data (addresses, payment info, credentials) into web pages. Per CWE-416 (Use After Free), the root cause is a dangling pointer: memory backing an Autofill object is freed while a reference to it remains live, so subsequent access operates on reclaimed heap memory. An attacker who controls page content and DOM lifecycle events can groom the heap to place attacker-controlled data where the freed object was, converting the dangling reference into a controlled read/write primitive and ultimately code execution. The CPE cpe:2.3:a:google:chrome identifies the affected product as the Chrome application across all builds prior to the fixed release; the impact is bounded to code execution inside the renderer sandbox rather than the host OS absent a separate sandbox escape.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but mandatory user navigation (UI:R); renderer-sandbox code execution keeps scope unchanged with full C/I/A on the compromised process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
Google Chrome desktop versions before 151.0.7922.72 contain a vulnerability in the Autofill component that allows remote code execution when users visit malicious websites. Successful exploitation exposes employee data and browsing activity to attackers. Immediate patching is required to prevent compromise across the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB