EUVD-2026-65766
GHSA-x6v8-wfj4-7jg6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryUser visits page in unpatched Chrome
-
ExploitCrafted JavaScript triggers Script UAF condition
-
ExecutionFreed heap memory reclaimed with attacker data
-
ImpactArbitrary code executes within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user running Google Chrome prior to version 152.0.7977.65 to actively visit a crafted HTML page, satisfying the UI:R condition in the CVSS vector. No authentication, login session, or special browser configuration is required - any default Chrome installation on a supported desktop platform is vulnerable when the user browses to attacker-controlled content. Exploitation is structurally limited to code execution within the Chrome renderer sandbox; achieving host OS-level access would require a separate, chained sandbox escape vulnerability not described in this CVE. JavaScript must be enabled in the browser, which is the default state and is required by the vast majority of modern web applications, so disabling it is not a practical real-world constraint on exploitation. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly reflects the low-friction, network-reachable nature of the flaw - any user browsing with an unpatched Chrome is one page visit away from exploitation. However, several signals temper raw urgency: EPSS is only 0.33% at the 25th percentile, indicating low observed exploitation probability relative to other public vulnerabilities; SSVC classifies exploitation status as 'none' and automatable as 'no', meaning no known automated exploitation tooling exists; and the Scope:Unchanged metric confirms impact is confined to the renderer sandbox, requiring a chained sandbox escape for full OS compromise. The SSVC 'total' technical impact rating refers to consequences within that contained scope. In aggregate, this is a genuine high-priority patch for organizations managing Chrome at scale, but the sandbox containment and absence of confirmed active exploitation distinguish it from a CVSS-equivalent vulnerability with system-wide scope. |
| Exploit ScenarioDerived | An attacker hosts a malicious webpage containing carefully crafted JavaScript designed to trigger a use-after-free in Chrome's Script engine by manipulating heap allocation and deallocation timing. A user on an unpatched Chrome desktop browser visits the page - via phishing link, malvertising redirect, or a compromised legitimate site - resulting in arbitrary code execution within the renderer process sandbox. No public exploit has been identified at time of analysis; reliable exploitation of heap UAF primitives requires significant memory exploitation skill and is not trivially automatable, consistent with SSVC automatable:no. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Use-after-free in Google Chrome's Script engine allows remote code execution confined to the renderer sandbox on all desktop platforms running versions prior to 152.0.7977.65. Exploitation requires only that a user visit a crafted HTML page - no authentication or special configuration is needed - making the attack surface broad wherever Chrome remains unpatched. No public exploit has been identified at time of analysis and CISA has not added this to KEV, but the CVSS 8.8 rating and SSVC 'total' technical impact designation warrant prompt patching across managed fleets.
RemediationAI
Update Google Chrome to version 152.0.7977.65 or later immediately using the browser's built-in update mechanism (Settings > Help > About Google Chrome) or via enterprise deployment tools such as Google Admin Console or software management platforms. The vendor-released patch is confirmed available per the stable channel advisory at chromereleases.googleblog.com. For organizations unable to patch immediately, restrict Chrome to known-good enterprise-managed sites using Chrome Browser Cloud Management URL allowlisting, which reduces exposure to attacker-controlled pages at the cost of user browsing flexibility. Enabling Enhanced Safe Browsing provides partial detection of known malicious URLs but does not prevent exploitation of novel attacker infrastructure. Disabling JavaScript via enterprise policy would fully block this attack vector but would render virtually all web applications non-functional and is not a sustainable workaround for most environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Script component of Google Chrome (CPE: cpe:2.3:a:google:chrome:*), which encompasses the browser's JavaScript execution subsystem. A use-after-free condition (CWE-416) arises when heap memory allocated for a script object is released but a dangling reference is retained and subsequently dereferenced during page rendering. An attacker who can control the timing and layout of heap allocations - achievable via crafted JavaScript - can reclaim the freed memory with attacker-controlled data and redirect execution flow. Chrome's multi-process renderer architecture and V8 sandbox mitigate but do not eliminate the risk; exploitation achieves arbitrary code execution within the renderer process sandbox rather than directly on the host OS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via webpage with active user visit required; no privileges needed; sandbox scope unchanged limits blast radius despite high renderer-level C/I/A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 152.0.7977.65 contain a vulnerability enabling unauthenticated remote code execution within the browser-any employee visiting a malicious website with an unpatched installation could be compromised. With no active exploitation currently detected but broad attack surface spanning standard web browsing, this poses material risk to end-user devices. Immediate universal patching to version 152.0.7977.65 is required to eliminate the attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB