EUVD-2026-65768
GHSA-26h5-m8jg-m9mq
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
S:C assigned independently because code execution 'outside the sandbox' explicitly crosses Chrome's security boundary to the host OS, warranting a scope change from the vendor's S:U choice.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
AnalysisAI
Use-after-free in the Chromoting (Chrome Remote Desktop) component of Google Chrome on Windows prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside Chrome's sandbox via crafted network traffic. The sandbox-escape outcome is the most critical aspect, elevating the real-world impact beyond a typical renderer flaw to full host-level code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Windows system to have Chrome Remote Desktop (Chromoting) active and its network listener reachable by the attacker - this is not a default Chrome configuration and affects only users who have installed and enabled Chrome Remote Desktop. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable flaw requiring no authentication, but the High Complexity (AC:H) rating is a meaningful moderating factor - exploitation requires precise memory-state conditions or race-condition timing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to a Windows host running an active Chrome Remote Desktop session sends crafted Chromoting protocol packets that trigger a use-after-free condition in the Chromoting memory handler. The memory corruption is weaponized to redirect execution flow past Chrome's sandbox boundary, yielding arbitrary code execution with the privileges of the Chrome process on the host OS. … |
| Remediation | Update Google Chrome on Windows to version 152.0.7977.65 or later, which is the confirmed vendor-released fix per the stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm Google Chrome version inventory across all Windows endpoints using your asset management and MDM systems to identify instances running versions prior to 152.0.7977.65. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today