EUVD-2026-63598
GHSA-x6v2-55rx-6qcx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryDelivers link via phishing or malvertising
-
ExploitVictim opens page in unpatched Chrome
-
ExecutionUAF triggered in DOM renderer
-
ImpactArbitrary code executes inside Chrome sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user running an affected version of Google Chrome (prior to 151.0.7922.173) to visit an attacker-controlled or compromised webpage containing a crafted HTML payload (UI:R). No authentication, account, or special browser configuration is required on the victim's part. The primary limiting factor is the user interaction requirement - passive drive-by exploitation is not possible without some form of delivery vector (phishing, malvertising, watering hole). A secondary limiting factor is the sandbox constraint: code execution occurs inside the Chrome renderer sandbox, so achieving full OS-level compromise requires chaining this vulnerability with an additional sandbox escape. No non-default configuration or specific operating system version is required beyond having an unpatched Chrome instance. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates low-complexity network exploitation requiring only user interaction - a realistic bar given that phishing or malvertising can reliably drive user visits to attacker-controlled pages. However, the EPSS score of 0.38% (31st percentile) significantly tempers urgency: despite the severity, exploitation probability within the next 30 days is historically low, consistent with a freshly disclosed browser UAF that lacks a public proof-of-concept. S:U (Scope Unchanged) is a moderately positive signal - the flaw achieves RCE inside the Chrome sandbox rather than achieving a full OS-level compromise directly, and a second-stage sandbox escape would be required for broader system impact. No KEV listing and no reported POC mean this is currently a patch-and-monitor priority rather than an emergency incident response trigger. Prevalence of Chrome in enterprise and consumer environments elevates aggregate organizational exposure regardless of low current exploitation probability. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that manipulates DOM object allocation and deallocation sequences to trigger the use-after-free condition in Chrome's DOM engine. A targeted user is directed to this page via phishing, malvertising, or a compromised website, and upon rendering, the attacker achieves arbitrary code execution within the Chrome renderer sandbox. No public proof-of-concept has been identified, so exploitation currently requires independent rediscovery or acquisition of an unexposed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 21, 2026
Use-after-free in Google Chrome's DOM implementation prior to 151.0.7922.173 enables remote unauthenticated attackers to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though execution is constrained within the Chromium sandbox, limiting the blast radius without a secondary escape primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.38%, suggesting active exploitation is not currently widespread despite the high severity rating.
RemediationAI
Update Google Chrome to version 151.0.7922.173 or later; this is the vendor-confirmed fixed release, documented at http://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0404570826.html. Chrome typically auto-updates, but administrators managing enterprise deployments should verify the channel update has propagated and confirm version via chrome://version. For environments where immediate patching is not feasible, restricting or disabling access to untrusted HTML content through web filtering or DNS-based controls reduces exposure, though this carries significant usability trade-offs. Enabling Chrome's Site Isolation feature (chrome://flags/#site-isolation-trial-opt-out) ensures renderer process sandboxing is active, which limits - but does not eliminate - the impact of sandbox-scoped RCE. There is no workaround that fully mitigates a UAF without applying the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 (Use After Free) describes a class of memory corruption where a program continues to use a pointer after the referenced memory has been freed. In Chrome's DOM (Document Object Model) engine - the component responsible for parsing and rendering HTML structure - this flaw can be triggered by a specially constructed HTML page that manipulates DOM object lifecycle in a way that causes freed memory to be accessed and potentially overwritten by attacker-controlled data. The affected product per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome versions preceding 151.0.7922.173 across platforms. Chromium's sandbox architecture provides a defensive layer, meaning code execution is initially constrained to the renderer process rather than the host OS - a meaningful but not absolute control.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network delivery via webpage (AV:N), no privileges needed (PR:N), but user must visit the page (UI:R); scope unchanged because execution stays within the Chrome sandbox (S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in DOM in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.173 contain a critical remote code execution vulnerability (CVE-2026-76021, CVSS 8.8) that enables unauthenticated attackers to compromise users through malicious websites. Although execution is confined to Chrome's security sandbox, compromised users face risk of credential theft and data exfiltration from browser-stored information. Given Chrome's widespread enterprise deployment, this vulnerability requires immediate patching to prevent large-scale security breaches.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB