EUVD-2026-65823
GHSA-2j76-q5hv-3cpm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via HTML page, no privileges or special config needed, user must visit page (UI:R), scope unchanged due to sandbox containment, full C/I/A within renderer.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Type confusion in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Type confusion in Chrome's Animation component allows remote unauthenticated attackers to potentially execute arbitrary code within the browser sandbox by luring a user to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required - the victim must visit a crafted HTML page in a vulnerable Chrome browser (PR:N/UI:R in CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score is driven by network delivery, low complexity, no required privileges, and high C/I/A impact (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making this technically severe. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a specially crafted HTML page containing malicious JavaScript or CSS animations designed to trigger the type confusion condition in Chrome's Animation component. A victim running a vulnerable Chrome version visits the page, whereupon the renderer processes the animation and confuses internal object types, causing memory corruption that an attacker can leverage to execute arbitrary code within the Chrome renderer sandbox. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later, which contains the vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Alert users and assess Chrome deployment scope organization-wide, focusing on systems with sensitive data access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today