EUVD-2026-65858
GHSA-p29w-rvmg-2p43
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page, no privileges but victim must open it (UI:R); sandbox escape justifies scope change (S:C) and full C/I/A impact, matching the 9.6 base.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Search in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox-escaping remote code execution in Google Chrome for Android (Search component) affects all builds prior to 152.0.7977.65, where a use-after-free (CWE-416) lets a remote attacker who lures a victim into opening a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Google rated the Chromium severity Medium, yet the CVSS 3.1 base score is 9.6 due to the scope change and full CIA impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to actively open or navigate to an attacker-controlled crafted HTML page in Chrome for Android (UI:R in the CVSS vector), and the description explicitly names social engineering as the delivery prerequisite - there is no drive-by/zero-click path indicated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are notably mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious web page containing JavaScript that manipulates the browser heap to trigger the use-after-free in Chrome's Search component, then socially engineers a target - for example via a phishing message or malicious ad - into opening the page on their Android device. If the exploit is reliable, the freed-object reuse is escalated into arbitrary code execution outside the renderer sandbox. … |
| Remediation | Vendor-released patch: update Google Chrome to 152.0.7977.65 or later on Android, which is the primary and sufficient fix; on Android this arrives through Google Play, so ensure automatic app updates are enabled and force-update Chrome across managed fleets. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Android Chrome deployments and verify automatic updates are enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today