EUVD-2026-65771
GHSA-8gp5-4955-5wrr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryPhish victim to open page
-
ExploitTrigger Views use-after-free
-
ExecutionReclaim freed object, hijack control flow
-
PersistExecute code outside sandbox
-
ImpactCompromise host process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires user interaction (CVSS UI:R): the victim must be socially engineered into visiting an attacker-controlled crafted HTML page in a vulnerable Chrome build older than 152.0.7977.65 - no authentication or prior privileges are needed (PR:N). Limiting factors: the attacker cannot trigger this without the victim opening the malicious page, the bug affects the Views UI component so the crafted content must exercise the vulnerable code path, and turning a use-after-free into a working sandbox escape is non-trivial. SSVC marks the flaw as not automatable and not currently exploited, and no public POC is available, all of which constrain realistic exploitation despite the network attack vector. |
| Impact | The signals are mixed and should temper the raw 9.6. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C, C:H/I:H/A:H) is severe because success means a full browser-process compromise with no authentication, and SSVC rates Technical Impact as 'total.' However, SSVC also lists Exploitation: none and Automatable: no, EPSS is only 0.46% (38th percentile), the vulnerability is not in CISA KEV, and no public exploit is identified - so this is a high-severity-but-not-yet-exploited issue rather than an emergency. The UI:R requirement (the victim must be socially engineered into opening a crafted page) and the general difficulty of turning a Views UAF into a reliable sandbox escape further lower near-term real-world risk. Given Chrome's ubiquity, patch quickly, but this does not carry the drop-everything urgency of an actively exploited zero-day. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that triggers the Views use-after-free and hosts it on a lookalike or compromised site, then uses phishing or a malvertising lure to get a victim to open it in a vulnerable Chrome build. When the page loads, the dangling pointer is reclaimed with attacker-controlled data, and control-flow hijack in the browser process yields arbitrary code execution outside the renderer sandbox. No public exploit is identified at time of analysis, and reliable exploitation would require solving heap grooming and modern browser mitigations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox-escaping remote code execution in Google Chrome (Views UI component) before 152.0.7977.65 allows a remote attacker to run arbitrary code on the host after luring a victim to a crafted HTML page. The flaw is a CWE-416 use-after-free rated High by Chromium and CVSS 9.6 due to the scope change (sandbox escape), but requires user interaction (visiting an attacker-controlled page) and has no public exploit identified at time of analysis. EPSS is modest (0.46%, 38th percentile) and CISA SSVC reports no known exploitation.
RemediationAI
Vendor-released patch: 152.0.7977.65 - update Google Chrome to 152.0.7977.65 or later via Chrome's built-in updater (chrome://settings/help) and relaunch to complete the update, then confirm the same baseline across Chromium-derived browsers as their vendors ship equivalent builds. In managed fleets, push the update through your enterprise update policy and verify the running version, since a downloaded update does not take effect until the browser restarts. Until every endpoint is updated, reduce exposure by discouraging users from opening untrusted links and by enabling Chrome's Enhanced Safe Browsing and site-isolation defaults; note these are mitigations, not fixes, and do not eliminate the underlying use-after-free. Reference the Chrome stable channel advisory: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect lives in Chrome's Views framework, the cross-platform C++ UI toolkit that renders the browser's widgets, menus, and window chrome. A use-after-free (CWE-416) occurs when an object is freed while a dangling pointer to it is still reachable; an attacker who can control heap allocation timing and reclaim the freed slot with attacker-chosen data can hijack a virtual call or write primitive to gain control of execution. Critically, because Views runs in the higher-privileged browser process rather than a sandboxed renderer, exploitation yields code execution 'outside the sandbox,' which the CVSS scope change (S:C) reflects. The single affected CPE is cpe:2.3:a:google:chrome across all platforms (desktop stable channel).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must open it (UI:R); sandbox escape crosses a trust boundary (S:C) giving full host compromise (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 152.0.7977.65 contain a critical remote code execution vulnerability that could allow attackers to take control of user workstations by tricking users into visiting malicious websites. No public exploits have been identified at this time, but the technical severity and user-facing nature of the vulnerability warrant urgent patching to mitigate organizational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB