EUVD-2026-74450
GHSA-rh43-69jr-v772
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network page-visit vector with mandatory user interaction, but DevTools-context requirement and heap-grooming make it AC:H; sandbox escape justifies S:C and full C/I/A on the host.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Remote code execution in Google Chrome's DevTools component before 153.0.8010.36 stems from a use-after-free (CWE-416) that, per the advisory, allows a crafted HTML page to execute arbitrary code outside the browser sandbox. All desktop Chrome builds prior to the fixed stable release are affected; the flaw was reported internally by the Chrome team, is fixed in the stable channel, and has no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to visit a crafted HTML page in a vulnerable Chrome build (prior to 153.0.8010.36), and - because the vulnerable code is DevTools - realistically requires the DevTools context to be active, making this the concrete triggering feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update Google Chrome to 153.0.8010.36 or later via the stable channel, then relaunch the browser to apply it; managed fleets should confirm the update through their Chrome Enterprise/policy management. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Chrome desktop installations across your environment and communicate the critical patch requirement to users and system administrators via security alert. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today