EUVD-2026-65861
GHSA-wmm4-886h-rf4q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage triggers use-after-free in Views
-
ExploitReclaim freed object, hijack control flow
-
ExecutionExecute code in browser process
-
ImpactEscape sandbox for host code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively visit or open an attacker-controlled crafted HTML page (CVSS UI:R, described as social engineering), so it is not fully automatable and cannot fire against a target with no user action. No authentication is required (PR:N) and the attack is over the network (AV:N) with low complexity (AC:L) against default Chrome configurations below 152.0.7977.65 - no special feature toggle or non-default setting is named in the description. The primary limiting factors are the mandatory user interaction and the need for the target to run an unpatched Chrome version; the sandbox-escape nature (S:C) means a successful trigger reaches beyond the renderer into the browser process. |
| Impact | The signals conflict and should be weighed carefully. CVSS 3.1 is 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C, full C/I/A impact), driven largely by the scope change of a sandbox escape, yet Google's own Chromium severity rating is only Medium and CISA's SSVC marks Exploitation:none and Automatable:no while Technical Impact:total. EPSS is low at 0.46% (38th percentile), the vulnerability is not in CISA KEV, and no POC is referenced - so real-world exploitation risk today is modest. Critically, exploitation requires user interaction (UI:R) via social engineering, which meaningfully limits mass/automated exploitation despite the network attack vector. The realistic picture: a technically severe bug (sandbox escape, total impact) but currently no evidence of active exploitation, so prioritize routine-but-prompt patching rather than emergency response. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page and uses social engineering (phishing email, malicious ad, or lured link) to get a victim running a vulnerable Chrome build to open it. The page triggers the use-after-free in the Views component, corrupts memory in the browser process, and executes arbitrary code outside the renderer sandbox on the victim's machine. No public exploit is identified at time of analysis, and success depends on the victim taking the bait (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Remote code execution in Google Chrome desktop before 152.0.7977.65 lets a remote attacker escape the browser sandbox by luring a victim to a crafted HTML page, exploiting a use-after-free in the Views UI framework to run arbitrary code with the browser process's privileges. The CVSS 9.6 score reflects a scope-changing sandbox escape (S:C), though Google rated the Chromium security severity only Medium and requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis, EPSS is low (0.46%), and CISA SSVC records exploitation status as none.
RemediationAI
Vendor-released patch: 152.0.7977.65 - upgrade Chrome to 152.0.7977.65 or later on all desktop platforms and restart the browser to load the fix, as documented in Google's Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html). Chrome normally auto-updates, so verify the running version via chrome://settings/help and confirm no policy is pinning an older build; in managed fleets, push the update through your management tooling and force a relaunch. As an interim compensating control until the update lands, reduce exposure to the social-engineering vector by warning users against opening untrusted links and by tightening web filtering/isolation for unknown sites, accepting the trade-off that this does not address the underlying bug and only lowers the chance a victim reaches a malicious page.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Views framework, the C++ UI toolkit that renders Chrome's browser-process user interface (windows, menus, dialogs, toolbars) rather than web page content. Because Views runs in the privileged browser process outside the renderer sandbox, memory corruption there can be leveraged to execute code beyond the sandbox boundary - matching the description's 'outside the sandbox' impact and the CVSS scope-change flag. A use-after-free arises when an object is freed while a dangling pointer to it remains reachable; an attacker who can control the timing of allocation/free and reoccupy the freed memory can hijack control flow. The single CPE, cpe:2.3:a:google:chrome:*, confirms desktop Chrome as the sole affected product.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable crafted page needing victim interaction (UI:R) triggers a browser-process UAF that escapes the sandbox, so S:C with full C/I/A impact; no auth needed (PR:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop versions before 152.0.7977.65 contain a critical remote code execution vulnerability that completely bypasses browser sandbox protections when users visit a malicious webpage. This exposes all Chrome-using employees to credential theft, malware installation, and unauthorized data access. Immediate patching across the organization is essential to prevent potential account compromise and lateral movement.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB