EUVD-2026-65867
GHSA-2mqv-6wp2-5mcp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure macOS Chrome user to visit
-
ExploitTrigger use-after-free in Views
-
ExecutionReclaim freed heap memory
-
PersistHijack control flow, escape sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open or visit an attacker-crafted HTML page in Google Chrome on macOS (CVSS UI:R user interaction), and the target must be running a Chrome build older than 152.0.7977.65. No authentication is needed against the victim (PR:N) and the attack is network-delivered (AV:N) with low complexity (AC:L). Limiting factors: the requirement for user interaction means purely passive or wormable mass exploitation is unlikely; the flaw is platform-specific to macOS builds of Chrome; and it does not apply to already-patched (>=152.0.7977.65) installations. CISA SSVC additionally assesses the vulnerability as not automatable. |
| Impact | The signals here conflict and must be weighed together rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) is elevated largely by the scope change (S:C) reflecting the sandbox escape, and it correctly captures that exploitation is network-reachable and unauthenticated but requires user interaction (visiting a malicious page). Against that, several lower-urgency indicators align: EPSS is only 0.33% (25th percentile), CISA's SSVC decision framework marks Exploitation as none and Automatable as no (though Technical Impact is total), the bug is not on the CISA KEV list, and Chromium's own security team rated it Medium severity - a notable contrast with the 9.6 base score. No public exploit code has been identified at time of analysis. The realistic near-term risk is therefore moderate: a serious, patchable memory-corruption bug with high theoretical impact but no evidence of weaponization or automation, so any organization running Chrome on Mac fleets should treat it as an urgent-but-routine browser patch rather than an emergency. If exploitation activity or a public POC emerges later, the priority should be re-evaluated immediately. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a macOS Chrome user to open it via a phishing link or malicious ad. When the page renders, it triggers the use-after-free in the Views component, corrupts heap memory, and executes attacker-controlled code outside the browser sandbox on the victim's Mac. No public exploit is identified at time of analysis, so this scenario is currently theoretical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox-escaping remote code execution in Google Chrome on macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Views UI component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code outside the browser sandbox. Google has shipped a fixed Stable channel build, and there is no public exploit identified at time of analysis. Despite a 9.6 CVSS, real-world signals are muted: EPSS is 0.33% (25th percentile), CISA SSVC lists exploitation as none, and Chromium rated the bug Medium severity.
RemediationAI
Vendor-released patch: 152.0.7977.65 - upgrade Google Chrome on macOS to 152.0.7977.65 or later via the Stable desktop channel, then fully restart the browser so the update takes effect (Chrome auto-updates but a relaunch is required to load the patched binary). Administrators managing Mac fleets should force the update through their MDM/enterprise update policy and verify version compliance across endpoints. No product-specific workaround is documented; if patching must be delayed, reduce exposure by limiting browsing to trusted sites and enforcing Chrome's Enhanced Safe Browsing, accepting that this only lowers likelihood and does not remove the vulnerability. Refer to the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html) and Chromium issue https://issues.chromium.org/issues/502109333 for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Views framework, the cross-platform C++ UI toolkit that renders and manages Chrome's native window widgets and controls. A use-after-free occurs when a heap object is freed but a dangling pointer to it is later dereferenced; an attacker who can control the timing of the free and re-allocate the freed memory with attacker-shaped data can achieve control-flow hijacking. Because the vulnerable code lives in the Views/browser-UI layer rather than purely inside the sandboxed renderer, successful exploitation results in code execution outside the renderer sandbox. The single affected CPE is cpe:2.3:a:google:chrome (macOS builds), and the issue is tracked upstream as Chromium issue 502109333 and ENISA EUVD-2026-65867.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered crafted page (AV:N/AC:L/PR:N) needs the victim to open it (UI:R); the sandbox escape justifies S:C with full C/I/A impact on the host.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on macOS (versions prior to 152.0.7977.65) contains a vulnerability that allows attackers to execute code with full system privileges when users visit malicious webpages, creating exposure for any macOS employee who uses Chrome for business-critical applications. Exploitation requires neither authentication nor sophisticated attack methods, making this a priority for immediate patching across all macOS systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB