EUVD-2026-65990
GHSA-x7q9-3f6g-gm6p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryRegister malicious ServiceWorker
-
ExploitTrigger use-after-free in ServiceWorker
-
ExecutionGroom heap for controlled reuse
-
PersistEscape renderer sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open or be redirected to an attacker-controlled HTML page in a vulnerable Chrome build (UI:R), and the page must register/manipulate a ServiceWorker to reach the vulnerable code path - ServiceWorkers are available to any HTTPS origin by default, so no special server or browser configuration is needed beyond the user visiting the page. No authentication is required against the browser (PR:N, unauthenticated remote attacker). Limiting factors: mandatory user interaction (must load the page), the need to defeat Chrome's sandbox and heap mitigations for reliable RCE (the 'outside the sandbox' claim implies a full escape that is non-trivial to weaponize), and applicability only to Chrome/Chromium builds earlier than 152.0.7977.65. |
| Impact | Signals conflict and should be weighed carefully. CVSS 3.1 is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) - network-reachable, no privileges, scope change, total impact - driven largely by the claimed sandbox escape. However, Google's Chromium severity is only Medium and CISA SSVC records Exploitation: none and Automatable: no (offset by Technical Impact: total). There is no KEV entry and no known POC, so this is not an active-priority zero-day today. The description's claim of code execution 'outside the sandbox' is unusually strong for a single ServiceWorker UAF and partly explains the gap between the 9.6 numeric score and Google's Medium rating - verify the exact exploit boundary with the vendor advisory. Net: patch promptly given ubiquity and total technical impact, but there is no evidence of widespread or automatable exploitation. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious web page containing JavaScript that registers and manipulates a ServiceWorker to trigger the use-after-free; a victim need only visit the page (UI:R). With controlled heap grooming the attacker corrupts memory, escapes the renderer sandbox, and executes native code on the victim's machine. No public POC or active exploitation is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox-escaping remote code execution affects Google Chrome desktop before 152.0.7977.65, where a use-after-free in the ServiceWorker component lets a remote attacker run arbitrary code outside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 3.1 score of 9.6 reflects the scope change (sandbox escape) and full CIA impact, though Google rated the Chromium severity only Medium and CISA's SSVC framework marks exploitation as none. No public exploit or CISA KEV listing exists at time of analysis, so risk is currently theoretical but high-impact.
RemediationAI
Vendor-released patch: update Google Chrome to 152.0.7977.65 or later on all desktop platforms; this is the primary and sufficient fix, distributed via Chrome's automatic updater - confirm by relaunching Chrome so the staged update applies. Reference the advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. For fleets that cannot update immediately, compensating controls include enforcing Chrome auto-update via enterprise policy, and - because exploitation requires loading attacker HTML - using site isolation (default) plus web filtering/URL allowlisting to reduce exposure to untrusted pages; note this degrades general browsing convenience and does not fully close the bug. Downstream Chromium browsers should be updated to whichever release incorporates the Chromium fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's ServiceWorker subsystem - the background script engine that intercepts network requests and enables offline/PWA behavior. ServiceWorkers run in the Blink renderer and manage complex object lifetimes across asynchronous events, a common source of dangling-pointer bugs. When a freed object is reused, an attacker who controls heap layout can gain a controlled read/write primitive and, per the description, chain it to escape the renderer sandbox and execute native code on the host. CPE data confirms the affected product is cpe:2.3:a:google:chrome across all sub-versions up to the fix.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote, unauthenticated, but requires user to load a page (UI:R) and reliable UAF-to-sandbox-escape needs heap grooming (AC:H); sandbox escape is a scope change (S:C) with total impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
2DescriptionCVE.org
Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions before 152.0.7977.65 contain a critical sandbox-escape remote code execution vulnerability (CVE-2026-78951, CVSS 9.6) that could allow attackers to execute arbitrary code and fully compromise affected systems when users open malicious webpages. No public exploit has been identified at time of analysis, but the broad exposure surface-affecting all Chrome users in your organization-combined with the potential for complete system compromise creates urgent remediation requirements. Deployment of Chrome 152.0.7977.65 or later across the enterprise is required immediately.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB