EUVD-2026-66001
GHSA-rp8f-w3xx-46gv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network delivery via crafted page (AV:N), social engineering mandates active user interaction (UI:R), no credentials required (PR:N), and execution stays within the Chrome sandbox (S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Type confusion in Google Chrome's DevTools component prior to version 152.0.7977.65 enables remote code execution within the browser sandbox when a victim is social-engineered into visiting a crafted HTML page. The flaw affects all Chrome platforms where DevTools is accessible and results in high confidentiality, integrity, and availability impact to the sandboxed process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires active user interaction: the victim must be social-engineered into visiting a crafted HTML page (UI:R per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high theoretical severity: network-delivered, low complexity, no privileges required, and full impact on the sandboxed process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page engineered to trigger a type confusion condition in Chrome's DevTools component, then lures the target through phishing, malvertising, or social media to visit the page. Once the victim loads the page in an unpatched Chrome browser, the type confusion flaw is triggered, allowing the attacker to execute arbitrary code within the Chrome renderer sandbox. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later, which contains the vendor-released fix for this type confusion flaw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, notify all users of the vulnerability and advise against clicking links from untrusted sources; audit your asset inventory to identify all Chrome deployments and versions in use across the organization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today