EUVD-2026-65990
GHSA-x7q9-3f6g-gm6p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote, unauthenticated, but requires user to load a page (UI:R) and reliable UAF-to-sandbox-escape needs heap grooming (AC:H); sandbox escape is a scope change (S:C) with total impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox-escaping remote code execution affects Google Chrome desktop before 152.0.7977.65, where a use-after-free in the ServiceWorker component lets a remote attacker run arbitrary code outside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 3.1 score of 9.6 reflects the scope change (sandbox escape) and full CIA impact, though Google rated the Chromium severity only Medium and CISA's SSVC framework marks exploitation as none. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to actively open or be redirected to an attacker-controlled HTML page in a vulnerable Chrome build (UI:R), and the page must register/manipulate a ServiceWorker to reach the vulnerable code path - ServiceWorkers are available to any HTTPS origin by default, so no special server or browser configuration is needed beyond the user visiting the page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts or injects a malicious web page containing JavaScript that registers and manipulates a ServiceWorker to trigger the use-after-free; a victim need only visit the page (UI:R). With controlled heap grooming the attacker corrupts memory, escapes the renderer sandbox, and executes native code on the victim's machine. … |
| Remediation | Vendor-released patch: update Google Chrome to 152.0.7977.65 or later on all desktop platforms; this is the primary and sufficient fix, distributed via Chrome's automatic updater - confirm by relaunching Chrome so the staged update applies. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Chrome versions prior to 152.0.7977.65, prioritizing internet-exposed workstations and high-value systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today