EUVD-2026-65857
GHSA-p736-wxj8-j2cw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page (social engineering)
-
DeliveryVictim performs crafted UI interaction
-
ExploitTrigger use-after-free in Sessions
-
ExecutionReclaim freed heap with controlled data
-
PersistEscape renderer sandbox
-
ImpactExecute arbitrary code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a remote attacker to deliver a malicious page to Google Chrome on Android (versions before 152.0.7977.65) AND to convince the victim, through social engineering, to perform a specific UI interaction that drives the vulnerable Sessions code path - the CVSS UI:R metric and the description's 'leveraging social engineering ... via UI Interaction' confirm this is mandatory, not incidental. No authentication is needed (PR:N). Limiting factors: it is not drive-by (user must act), CISA SSVC marks it non-automatable, it targets the Android build specifically, and only unpatched clients below 152.0.7977.65 are vulnerable; successful memory-corruption exploitation to reliably escape the sandbox is technically non-trivial despite the AC:L rating. |
| Impact | Signals here conflict and warrant scrutiny. The NVD CVSS 3.1 base score is 9.6 (Critical) driven by scope change plus C:H/I:H/A:H, yet Google's own Chromium security team rated the bug 'Medium' severity - a significant discrepancy that should be reconciled before treating this as a top-tier emergency. Supporting a lower real-world priority: EPSS is only 0.23% (14th percentile), there is no KEV listing, and CISA SSVC reports Exploitation=none and Automatable=no (though Technical Impact=total, consistent with sandbox-escape RCE). The vector's AC:L/PR:N is offset by UI:R plus the requirement for social engineering, so exploitation is not drive-by/automatable. Verdict: a genuinely high-impact memory-corruption bug worth patching promptly given Chrome's ubiquity, but current evidence points to low near-term exploitation likelihood rather than active, widespread attack - the 9.6 CVSS overstates practical urgency relative to Google's Medium rating and the low EPSS/SSVC signals. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page and uses social engineering (e.g., a phishing message) to get an Android Chrome user to visit it and perform a specific UI action, such as interacting with a tab/session restore prompt. That interaction triggers the use-after-free in the Sessions component, letting the attacker's controlled data reclaim freed memory and execute code that escapes the sandbox. No public exploit is identified at time of analysis, and the required user interaction limits automation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.65 stems from a use-after-free in the Sessions component (CVE-2026-79129, CWE-416). A remote attacker who lures a victim into a specific UI interaction (social engineering) can corrupt freed memory to run arbitrary code outside the renderer sandbox. Google has shipped a fixed build; no public exploit identified at time of analysis, EPSS is low (0.23%, 14th percentile), and CISA SSVC lists exploitation status as none.
RemediationAI
Vendor-released patch: update Google Chrome on Android to 152.0.7977.65 or later via Google Play; this is the primary and complete fix. Because Chrome auto-updates, ensure managed/MDM fleets are not pinning an older version and force the update where policy controls exist. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. Until the update lands, reduce exposure by avoiding untrusted links/sites and cautioning users against unexpected UI prompts, since exploitation requires user interaction; enterprise deployments can additionally enforce Site Isolation (default on) and restrict installation of untrusted content. No separate configuration workaround is documented, so patching is the authoritative remedy.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's Sessions subsystem, which manages tab/session state and restoration on Android. Use-after-free occurs when a pointer to heap memory is retained and dereferenced after that memory has been freed, letting an attacker reclaim the freed allocation with controlled data and hijack object function pointers or vtables. Notably, the description states the outcome is code execution 'outside the sandbox,' meaning this bug is exploitable to breach Chromium's renderer/site-isolation sandbox boundary rather than being confined to the renderer process - reflected in the CVSS scope-changed (S:C) metric. The affected CPE is cpe:2.3:a:google:chrome (all versions covered by the fix), specifically the Android build per the description.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered but requires victim UI interaction (UI:R) and non-trivial UAF/sandbox-escape exploitation (AC:H); no auth (PR:N); sandbox escape gives scope change and full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Sessions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for Android before version 152.0.7977.65 contains a critical sandbox-escape vulnerability allowing unauthenticated remote code execution when users interact with malicious content. Organizations with Android users face potential device-level compromise; immediate patching is essential despite current low exploitation rates.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB