EUVD-2026-54132
GHSA-m348-r3cc-4chm
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network delivery via HTML page; AC:H encodes required renderer pre-compromise; S:C and C/I/A:H reflect full OS access after sandbox escape.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Use-after-free exploitation in Google Chrome's Media component on Windows enables sandbox escape for attackers who have already compromised the renderer process. Chrome versions prior to 151.0.7922.109 on Windows are affected, with a crafted HTML page serving as the trigger mechanism to corrupt freed memory and break out of the renderer sandbox. SSVC rates current exploitation as none and non-automatable, though the total technical impact class reflects full OS-level compromise if the two-stage attack chain is completed successfully.
Technical ContextAI
CWE-416 (Use After Free) describes a memory safety flaw in which freed memory is subsequently accessed via a dangling pointer, enabling an attacker to corrupt heap structures or repurpose freed allocations. This instance resides in Chrome's Media subsystem on Windows - the component responsible for processing audio, video, and related codec operations from web content. In Chromium's architecture, the renderer process handles untrusted HTML and media content in a sandboxed environment isolated from the OS and browser kernel process. A UAF in Media can allow an attacker with renderer-level execution to manipulate internal object references in ways that subvert Chrome's sandbox boundary, escalating from constrained renderer code execution to arbitrary OS-level code execution. The affected CPE encompasses Google Chrome for Windows, all builds prior to version 151.0.7922.109.
RemediationAI
Update Google Chrome on Windows to version 151.0.7922.109 or later, as the vendor-released patch is confirmed available via the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome's automatic update mechanism will apply this for most users; enterprise administrators should verify update propagation through Google Chrome management policies or endpoint MDM tooling. Where immediate patching is not feasible, restricting user access to untrusted or external web content via proxy policy or browser lockdown profiles reduces the likelihood of encountering a crafted trigger page, though this does not eliminate the underlying flaw. Enforcing Chrome's renderer sandbox hardening and Site Isolation (already enabled by default) limits the blast radius of a renderer compromise but does not prevent this specific sandbox escape once a renderer is already controlled by an attacker.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today