EUVD-2026-66061
GHSA-5xf3-rprr-gf76
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable via a crafted page (AV:N) but a use-after-free needing heap grooming/race timing justifies AC:H over AC:L; UI:R for page visit, S:C for the sandbox escape, and C/I/A:H for full host RCE.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Remote code execution in Google Chrome desktop before 152.0.7977.65 arises from a use-after-free in the ServiceWorker subsystem that a crafted HTML page can trigger to run attacker code outside the renderer sandbox. Any user browsing to a malicious page with a vulnerable build is exposed, and successful exploitation yields full compromise of the host user context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The concrete prerequisite from the description is that the victim must load a crafted HTML page in a vulnerable Chrome build (before 152.0.7977.65) that exercises the ServiceWorker code path - the CVSS UI:R metric confirms user interaction (navigating to the attacker-controlled page) is mandatory, so this cannot be triggered without the victim opening content. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals here are in tension and must be reconciled rather than taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a malicious website or compromises an ad/third-party script and lures a victim running a vulnerable Chrome build to open the page (e.g., via phishing link or malvertising). The crafted HTML drives ServiceWorker operations that trigger the use-after-free, and by grooming the heap the attacker reclaims the freed object to hijack execution and break out of the sandbox onto the host. … |
| Remediation | Vendor-released patch: update Google Chrome to 152.0.7977.65 or later on all desktop platforms via the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html); in most enterprises the fastest path is to force the browser to relaunch so the pending auto-update applies, and to push the minimum version through Chrome Browser Cloud Management or Group Policy so users cannot defer it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, deploy monitoring to identify all systems running Chrome versions prior to 152.0.7977.65 and flag those used by high-risk roles or handling sensitive data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today