EUVD-2026-69740
GHSA-4mjv-2463-x3f5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page with malicious WebRTC session
-
DeliveryVictim visits page in unpatched Chrome
-
ExploitWebRTC UAF triggered during object lifecycle event
-
ExecutionHeap corruption achieved in renderer process
-
ImpactArbitrary code executed inside Chrome sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must actively visit an attacker-controlled HTML page using an unpatched Chrome browser (prior to 152.0.7977.75) - user interaction is required (UI:R). Exploitation is constrained to code execution within Chrome's renderer sandbox; compromising the underlying OS additionally requires a separate sandbox escape vulnerability not present in this CVE. No authentication, account, or special browser configuration is required from the attacker's perspective. WebRTC support must be enabled, which is the Chrome default - users or enterprises that have explicitly disabled WebRTC via policy are not exposed. |
| Impact | The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-accessible, low-complexity vulnerability requiring only a single user interaction - visiting a page - with high impact to confidentiality, integrity, and availability. However, the Chromium team's internal severity of 'Medium' is a material signal: Google calibrates browser vulnerability severity by whether sandbox containment holds, and S:U in the CVSS vector confirms the exploit achieves execution inside the renderer sandbox only. No public POC exists and the vulnerability is not listed in CISA KEV, further supporting that exploitation is not yet widespread. Real-world risk is meaningful for unpatched enterprise Chrome fleets but is mitigated by Chrome's auto-update mechanism and sandbox isolation. The absence of a sandbox escape step makes this a high-severity browser bug rather than an immediately critical system-compromise risk. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that initiates a WebRTC session, triggering a use-after-free in Chrome's media stack during object teardown or callback processing. When a user visits the page with an unpatched Chrome browser, heap memory is corrupted, allowing the attacker to redirect execution and run arbitrary code within Chrome's renderer sandbox. No public POC is currently available, but the AC:L rating indicates the trigger mechanism is not especially complex for a skilled attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Remote code execution inside Chrome's sandbox is achievable via a use-after-free in WebRTC, triggered when a victim visits a specially crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75 across desktop platforms. No public exploit code or CISA KEV listing has been identified at time of analysis, though the sandboxed execution boundary limits the practical impact compared to the raw CVSS 8.8 score - Google's own Chromium severity rating of 'Medium' reflects this containment.
RemediationAI
Upgrade Google Chrome to version 152.0.7977.75 or later, confirmed as the patched release via Google's stable channel update blog (chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html). Chrome's auto-update mechanism should deliver this patch automatically; administrators managing enterprise fleets should verify deployment via policy or fleet management tooling. If immediate upgrade is not possible, consider disabling or restricting WebRTC via enterprise policy (WebRtcAllowed: false) as a compensating control - note this will break legitimate video conferencing and peer-to-peer web applications. Blocking access to untrusted or unvetted external web pages via proxy policy can reduce exposure but is not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebRTC (Web Real-Time Communications) is a built-in browser API enabling peer-to-peer audio, video, and data channels directly in JavaScript without plugins. Chrome's WebRTC implementation is native C++ code executing in the renderer process, which runs within the Chrome sandbox. CWE-416 (Use After Free) arises when a memory object is freed but a dangling pointer to that allocation is retained and later dereferenced; in a complex media stack like WebRTC, this typically occurs during object teardown or event callback sequencing. Exploiting a UAF in a browser renderer allows an attacker to corrupt the renderer heap and redirect execution, achieving arbitrary code execution within the renderer's sandboxed process. Achieving full OS-level code execution would additionally require a separate sandbox escape primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N), low complexity UAF trigger (AC:L), no auth needed (PR:N), single user interaction required (UI:R), scope unchanged as execution stays within renderer sandbox (S:U), full triad impact within the sandboxed process (C:H/I:H/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome users are vulnerable to remote code execution through malicious websites prior to version 152.0.7977.75, though the browser's built-in security contains the attack within Chrome itself and prevents access to the broader system; no public exploit identified at time of analysis. A patch is available and should be deployed immediately to all endpoints to eliminate this attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 152 Memory Safety and Authorization Flaws
View all 26Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB