EUVD-2026-50858
GHSA-6368-p932-wpc7
Severity by source
Sources disagree (Low–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector confirmed by description; no privileges required but user must open crafted HTML; only confidentiality impact (memory disclosure) with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Use-after-free in Chrome's DataTransfer component on Windows exposes process memory to local attackers who can deliver a crafted HTML page to a victim. The flaw affects all Chrome versions on Windows prior to 151.0.7922.72 and results in high-confidence confidentiality loss with no integrity or availability impact. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with CISA SSVC classifying exploitation as 'none' and technical impact as 'partial' - making this a low operational priority despite the High confidentiality CVSS sub-score.
Technical ContextAI
CWE-416 (Use After Free) describes a condition where memory is accessed after it has been freed, potentially exposing stale data or allowing type confusion. The vulnerable component is the DataTransfer API, which Chrome exposes to web content to support clipboard and drag-and-drop operations - a common attack surface in browser security research. The CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) confirms this is a Google Chrome application-level flaw, not a kernel or OS issue, and the vendor has restricted the impact to the Windows platform specifically. Because the CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U, exploitation is limited to the local attack surface and requires the victim to interact with a crafted HTML page - consistent with a renderer-side memory corruption triggered via JavaScript or DOM manipulation of DataTransfer objects.
RemediationAI
The primary fix is updating Google Chrome on Windows to version 151.0.7922.72 or later, confirmed as the patched release in the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this patch automatically to most users; administrators managing enterprise deployments should verify update policy enforcement via group policy or Chrome Browser Cloud Management. If immediate patching is not feasible, a compensating control is to restrict users from opening untrusted or externally-sourced HTML files directly in Chrome on Windows, and to enforce Safe Browsing policies to reduce delivery of crafted pages. Disabling JavaScript would prevent DOM-level DataTransfer manipulation but carries significant usability trade-offs that make it impractical for most environments. Given the local attack vector and low EPSS score, patch rollout within the standard monthly cycle is appropriate for most organizations.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today