EUVD-2026-91709
GHSA-m4rg-hrvv-hwc6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage invokes FedCM flow
-
ExploitTrigger use-after-free in FedCM
-
ExecutionCorrupt freed object for code execution
-
PersistEscape renderer sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to visit or load attacker-controlled HTML in Chrome that exercises the FedCM (Federated Credential Management) API, which triggers the use-after-free. The limiting factor is user interaction (CVSS UI:R) - the target must navigate to or render the malicious page; no authentication is required (PR:N) and no special Chrome configuration is noted beyond default FedCM availability. The attack is network-reachable (AV:N) and low-complexity (AC:L), and success yields code execution outside the browser sandbox (scope change, S:C), affecting the underlying host rather than only the renderer. |
| Impact | Signals diverge sharply here. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) describes a remote, low-complexity, unauthenticated sandbox-escaping RCE requiring only that a victim load a crafted page - a severe technical profile corroborated by SSVC Technical Impact of 'total' and CWE-416 (use-after-free). However, the real-world exploitation signals are currently cool: EPSS is only 0.21% (11th percentile), the vulnerability is NOT in CISA KEV, SSVC marks Exploitation as 'none' and Automatable as 'no', and no public exploit was identified at time of analysis. This is a genuine high-priority patch target because of ubiquity (every Chrome desktop install) and total technical impact, but it is NOT presently evidence of active exploitation - the low EPSS and SSVC 'none' indicate no observed in-the-wild activity yet. Note the tension to verify: the input Tags list 'Denial Of Service' alongside RCE, but the description and CVSS (C:H/I:H/A:H with full code execution outside the sandbox) point to arbitrary code execution as the primary impact, with DoS being at most a lesser secondary outcome of the memory corruption. Browser UAF sandbox escapes historically attract exploit development quickly, so the quiet exploitation signals may lag rather than reflect low eventual risk. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that triggers the use-after-free in Chrome's FedCM (Federated Credential Management) implementation when a victim visits it. By grooming the freed object, the attacker achieves arbitrary code execution that escapes the renderer sandbox, running code on the victim host. No public exploit code was identified at time of analysis, and user interaction (visiting the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Use-after-free in the FedCM (Federated Credential Management) component of Google Chrome can allow a remote attacker to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page, with the only stated precondition being user interaction (CVSS UI:R); no authentication is required per the assessed vector (PR:N). The 9.6 score reflects a scope change (S:C) - successful exploitation escapes the renderer sandbox onto the underlying host - but signals diverge sharply: EPSS is only ~0.21% (11th percentile) and CISA's SSVC records Exploitation: none, so no public exploit has been identified at time of analysis. Google has released a fix in Chrome 154.0.8037.97, and Chromium rates the underlying issue High severity.
RemediationAI
The primary fix is to upgrade Google Chrome to version 154.0.8037.97 or later (vendor-released patch per the Chrome stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html), then fully restart the browser so the new binary is loaded, and to push the update to managed fleets via enterprise update policies; patch availability is confirmed but there is no confirmed active exploitation to justify emergency out-of-band handling beyond normal rapid-patching SLAs. If immediate upgrade is not possible, compensating controls are limited because the attack needs no authentication and only a rendered page: consider restricting FedCM/federated sign-in capability through enterprise policy or feature flags where such controls exist, accepting the trade-off that federated identity providers used for sign-in will break for affected users, and pair it with network-level blocking of known malicious or untrusted origins, which is only a partial measure since any attacker-controlled page is a valid vector. Sandbox hardening, site isolation, and post-exploitation detection are detective rather than preventive here - the assessed scope change (S:C) means a successful exploit leaves the renderer, so host-level EDR and browser-crash telemetry on the FedCM/Blink process should be tuned to catch heap-corruption indicators; downgrading or blocking the browser entirely is the only full mitigation but is operationally impractical for most organizations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-416 use-after-free in the FedCM (Federated Credential Management) implementation of Chromium's Blink engine - the browser-mediated API that lets sites offer federated sign-in without third-party cookies. In a use-after-free of this class, an object backing FedCM state (a credential, request, or dialog-related structure) is freed while a dangling reference is still reachable; subsequent attacker-influenced interaction with the API dereferences the stale pointer, allowing heap manipulation and, per the assessed vector, code execution that crosses the sandbox boundary (S:C). The remote, low-complexity attack path (AV:N/AC:L) plus the CPE entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and the tag set (RCE, Memory Corruption, Use After Free, Denial Of Service) confirm this is memory-safety corruption in the Chrome browser rather than a logic error, and EPSS/SSVC metadata indicate the bug is not considered automatable for mass exploitation. The patch reference is the Chrome stable-channel release at 154.0.8037.97.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page (AV:N, AC:L, PR:N) needs victim to load it (UI:R); UAF escapes the sandbox to the host (S:C) yielding full code execution (C:H/I:H/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome's FedCM component has a critical sandbox-escape vulnerability that could let a crafted web page execute code on the underlying host, putting any employee browsing with an unpatched browser at risk. Although the current exploitation status is no public exploit identified at time of analysis and vendor patches are available, the potential for endpoint compromise and follow-on data or lateral-movement risk makes this a priority for management attention. Leadership should ensure rapid Chrome version compliance, especially across distributed and remote workforces.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB