EUVD-2026-61229
GHSA-j938-c23g-prvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page
-
DeliveryDeliver link via phishing or compromised site
-
ExploitVictim visits page in unpatched Chrome on macOS
-
ExecutionTrigger use-after-free in Browser process
-
ImpactExecute arbitrary code outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim is running Google Chrome on macOS with a version below 151.0.7922.169. The attacker must successfully socially engineer the victim into visiting a crafted HTML page (UI:R), meaning passive network positioning alone is insufficient - active deception is required. The vulnerability is limited to the macOS platform; Chrome on Windows and Linux are not affected by this CVE. No authentication to any service is required from the attacker's perspective. Factors limiting exploitation: the UI:R requirement prevents fully automated exploitation; the Mac-only scope excludes a large fraction of Chrome's installed base; and no public POC or KEV listing exists at time of analysis. |
| Impact | The CVSS 8.8 score reflects a network-reachable, unauthenticated (PR:N), user-interaction-required (UI:R) attack with high confidentiality, integrity, and availability impact and no scope change (S:U). The sandbox escape consequence is the critical differentiator - typical renderer compromises still require a second-stage escape; this CVE delivers both in one step. SSVC signals 'Exploitation: none' and 'Automatable: no', consistent with the UI:R requirement that prevents drive-by mass exploitation. EPSS data is not provided, but the combination of no KEV listing and no reported POC suggests opportunistic mass targeting is not yet occurring. Despite that, even a mid-sized municipal IT team in zabrze should treat this as urgent given the total technical impact rating and the macOS-specific exposure surface - patching Chrome on managed endpoints is low-friction and should proceed without waiting for active exploitation confirmation. The Mac-only scope somewhat limits blast radius compared to a cross-platform flaw, but macOS endpoints are common in enterprise and creative/developer environments. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that triggers a use-after-free condition in Chrome's Browser process on macOS, then distributes the link via phishing email or compromised website. A targeted user on macOS is socially engineered into visiting the page in an unpatched Chrome session. The memory corruption is leveraged to achieve arbitrary code execution in the Browser process - outside the renderer sandbox - with the privileges of the logged-in user, without requiring any additional sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. No public exploit code or CISA KEV listing has been identified at time of analysis, but the sandbox escape impact elevates real-world severity significantly.
RemediationAI
Update Google Chrome on macOS to version 151.0.7922.169 or later, which is confirmed as the patched release per the vendor stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html. Chrome's built-in auto-update mechanism will deliver this patch; administrators managing enterprise fleets should verify deployment via policy or endpoint management tooling. If immediate patching is not feasible, the most effective compensating control is to restrict access to untrusted or external web content using DNS filtering or proxy allow-listing, reducing the social engineering surface. Disabling JavaScript broadly is technically effective but operationally disruptive and impractical for most environments. Note that no workaround eliminates the underlying memory corruption - only the patch resolves it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 (Use After Free) occurs when heap-allocated memory is accessed after being freed, enabling attackers to control or corrupt memory that has been reclaimed. In Chromium's Browser process - which operates outside the renderer sandbox - a use-after-free can directly yield code execution in a privileged context. The affected component is the Browser process on macOS; the Chromium issue tracker references bug 534862220. The CPE-implied scope is Chrome versions below 151.0.7922.169 on Mac. Because the Browser process sits above the sandbox boundary, exploitation bypasses Chromium's primary isolation defense and achieves full OS-level code execution without needing a separate sandbox escape primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N), no special conditions (AC:L), no attacker auth needed (PR:N), requires user click (UI:R); full host impact but no scope change since Browser process is the target.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on macOS (versions prior to 151.0.7922.169) contains a critical vulnerability (CVE-2026-76040) enabling remote code execution by circumventing application sandboxing protections. No public exploit identified at time of analysis, but the sandbox escape capability poses significant organizational risk if employees are socially engineered to visit attacker-controlled websites. Immediate patching across all macOS Chrome deployments is essential to restore security controls.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB