Use After Free
Monthly
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4, ≤13.2.4, ≤2026.1.1) and Foxit PDF Reader (≤2026.1.1) allows an attacker to corrupt object state and read an illegal memory address when a victim opens a crafted PDF that manipulates form-field properties via embedded JavaScript. The immediate observed impact is an application crash (denial of service), but the CWE-416 root cause and the vendor's CVSS confidentiality/integrity ratings indicate potential for arbitrary code execution in the context of the user. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4) and Foxit PDF Reader (≤2026.1.1) allows a crafted PDF containing malicious form-reset JavaScript to trigger a stale control-pointer dereference, crashing the application and potentially enabling arbitrary code execution in the victim's context. Exploitation requires the user to open a booby-trapped document; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Foxit, the reporting vendor, has issued a security bulletin covering the affected versions.
Use-after-free during PDF field processing in Foxit PDF Editor and Foxit PDF Reader allows a crafted document to delete the current page and then reuse now-dangling field objects, causing an illegal memory read and application crash. Affects Foxit PDF Editor through 14.0.4 / 2026.1.1 and Foxit PDF Reader through 2026.1.1; exploitation requires a user to open a malicious PDF. No public exploit identified at time of analysis and the flaw is not in CISA KEV; vendor (Foxit) reported it and tags it primarily as denial of service / memory corruption.
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader is triggered when JavaScript embedded in a malicious PDF resets form fields and re-enters the interface, causing the application to invoke a method on a freed native object. An attacker who convinces a user to open a crafted PDF can crash the application, and because the flaw is a use-after-free (CWE-416), it carries potential for memory-corruption abuse beyond denial of service. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF containing embedded JavaScript to trigger a use-after-free (CWE-416) when the script manipulates a list box field and the form is subsequently reset. A victim who merely opens the malicious document can have the application dereference a dangling pointer to freed form-field memory; Foxit itself reported the flaw and CVSS rates it 7.8. No public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis, though use-after-free in a scriptable PDF engine is a classic path toward code execution.
Use-after-free in the GLX dispatch layer of X.Org X Server and Xwayland allows an authenticated X client to corrupt heap memory by triggering a contextTags array reallocation while a stale pointer is still held. The attacker crafts a deterministic sequence of exactly 34 GLX requests - 17 CreateContext and 17 MakeCurrent calls - to force the realloc, after which GlxFreeContextTag writes zeros into freed memory at five fixed offsets. No CVSS vector or KEV listing is present; the vulnerability was discovered by an anonymous researcher through Trend Micro Zero Day Initiative (ZDI-CAN-30561), indicating active vulnerability research interest though no public exploit has been confirmed.
Memory corruption in the OpenSSH client (ssh) before 10.4 lets a malicious or compromised SSH server trigger a use-after-free on the connecting client by changing its host key during a key re-exchange (rekey), potentially leading to information disclosure or code execution in the client process. Only the client side is affected; the server is not vulnerable. There is no public exploit identified at time of analysis and it is not on CISA KEV, and EPSS is low (0.25%, 16th percentile), but the flaw is fixed in OpenSSH 10.4/10.4p1.
Arbitrary code execution in an unnamed ICS/OT application arises from a use-after-free (CWE-416) triggered when the software parses a specially crafted file, letting an attacker run code in the context of the current process. The flaw was reported through CISA's ICS-CERT (advisory ICSA-26-188-06) and carries a CVSS 4.0 base score of 8.4; exploitation is local and requires a user to open the malicious file. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation and host memory corruption in the Linux kernel's KVM x86 shadow paging (MMU) subsystem allows a low-privileged actor with control over a guest/VMM to trigger a use-after-free in the host kernel. The flaw is an incomplete fix for commit 0cb2af2ea66ad: kvm_mmu_get_child_sp() reuses a shadow page without comparing its role, so a stale rmap entry survives after a memslot is dropped and the shadow page is freed, and later gfn walks dereference a pointer into freed memory. A public proof-of-concept exists (flagged by Italy's ACN/CSIRT) and SSVC rates technical impact as total, but it is not on CISA KEV and EPSS is low (0.18%), indicating no confirmed widespread active exploitation.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that an unauthorized, remote attacker can trigger to run arbitrary code. Exploitation requires the victim to interact with attacker-controlled web content, and the CVSS 3.1 vector marks high attack complexity (AC:H) despite requiring no privileges (PR:N). Microsoft has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that an unauthenticated, network-based attacker can trigger to run arbitrary code in the browser process. Exploitation requires the victim to interact — typically by visiting a malicious or compromised web page — and the CVSS 3.1 score of 8.3 reflects high attack complexity plus a scope change consistent with a renderer sandbox escape. There is no public exploit identified at time of analysis and no CISA KEV listing, though the underlying Chromium engine origin (tags reference Google) means a shared upstream root cause across Chromium browsers is likely.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) that an unauthorized network attacker can trigger to run arbitrary code in the browser process. Exploitation requires the victim to interact with attacker-controlled content (UI:R) and involves high attack complexity (AC:H), so a user must be lured to a malicious or compromised page. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; Microsoft has released a fix.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory-corruption bug (CWE-416) that an unauthorized attacker can trigger over the network to run arbitrary code in the browser's context. Exploitation requires the victim to interact with attacker-controlled web content and the CVSS vector flags high attack complexity, so successful attacks are not trivial. There is no public exploit identified at time of analysis and no CISA KEV listing, but a vendor patch is available from Microsoft.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) that lets an unauthenticated attacker run arbitrary code when a victim visits a malicious web page. All Edge Chromium versions prior to the vendor-patched build are affected, and the CVSS 3.1 base score is 8.8 (High). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation requires user interaction such as browsing to attacker-controlled content.
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthorized attacker to run arbitrary code when a victim views attacker-controlled web content, stemming from a use-after-free memory-corruption flaw (CWE-416). The scope-changed CVSS vector (S:C) indicates the bug can breach the browser's sandbox boundary. Microsoft has released a fix; there is no public exploit identified at time of analysis (CVSS E:U) and it is not listed in CISA KEV.
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated attacker run arbitrary code when a victim is lured into loading attacker-controlled web content that triggers a use-after-free memory corruption. The flaw carries a CVSS 3.1 base of 7.5 and requires user interaction, and the CVSS temporal metrics (E:U, RL:O, RC:C) indicate the issue is confirmed and officially patched with no public exploit identified at time of analysis. Because Edge shares Chromium's rendering engine, the underlying defect is likely rooted in an upstream Chromium/Blink component (the intel tags also reference Google).
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that an unauthenticated attacker can trigger over the network when a victim loads attacker-controlled web content. Microsoft has released an official fix and rates the issue 7.5 (High), tempered by high attack complexity and required user interaction; the CVSS temporal data marks exploit maturity as Unproven (E:U), so there is no public exploit identified at time of analysis and no CISA KEV listing. The vendor tags ('Google', 'Use After Free', 'Denial Of Service') indicate this most likely tracks an upstream Chromium engine defect inherited by Edge.
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticates against an external LDAP server. A race condition in the IKEv2 LDAP authentication path can be driven into a use-after-free (CWE-416) inside the iked daemon, letting a remote unauthenticated attacker execute arbitrary code in the context of that process. No public exploit identified at time of analysis, and the CVSS 4.0 base score of 9.2 is tempered by high attack complexity and a probabilistic attack requirement (AC:H/AT:P), reflecting the difficulty of reliably winning the race.
Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem lets a local unprivileged process corrupt kernel memory by racing a listening-socket close against a concurrent HCI disconnect. When l2cap_sock_cleanup_listen() walks not-yet-accepted child sockets while hci_rx_work drives l2cap_conn_del() to free those same child sockets and their l2cap_chan, cleanup_listen() dereferences freed objects, yielding a KASAN slab-use-after-free that can crash the host or enable further memory-corruption primitives. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV, but the vendor confirmed reproducibility (12 UAF reports per run before the fix).
Arbitrary code execution in the V8 JavaScript engine of Google Chrome prior to 150.0.7871.46 lets a remote attacker run code inside the renderer sandbox after luring a victim to a crafted HTML page and getting them to perform specific UI gestures. Rated High by Chromium, it carries CVSS 7.5 (AC:H/UI:R) reflecting the required user interaction and attack complexity. There is no public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), consistent with SSVC exploitation status of 'none'.
Remote code execution risk in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.46) arises from a use-after-free that a remote attacker can trigger by luring a victim to a crafted HTML page, leading to heap corruption and potential arbitrary code execution in the renderer. The CVSS 8.8 rating reflects high impact with only user interaction (visiting a page) required, though Google rated the Chromium security severity as Low and no public exploit is identified at time of analysis. EPSS is low at 0.18% (8th percentile) and CISA SSVC records no known exploitation.
Use-after-free in Chrome's V8 JavaScript engine (versions before 150.0.7871.46) lets a remote attacker achieve arbitrary code execution inside the renderer sandbox by luring a victim to a crafted HTML page. Chromium rated this Medium severity, but the CVSS 8.8 reflects high confidentiality, integrity, and availability impact requiring only a single user click; there is no public exploit identified at time of analysis and CISA's SSVC framework records no known exploitation. Because scope is unchanged (S:U), code execution is confined to the sandbox and does not by itself constitute a full host compromise.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.46) allows an attacker to run arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; Chromium rated it Medium severity while NVD assigns CVSS 8.8. No public exploit has been identified at time of analysis, and CISA's SSVC framework records exploitation status as 'none'.
Arbitrary code execution within the V8 sandbox affects Google Chrome desktop builds prior to 150.0.7871.46, where a use-after-free in the V8 JavaScript engine lets a remote attacker run code inside the sandbox when a victim opens a crafted HTML page. Google internally rated the Chromium security severity as Low and the execution is contained to the V8 sandbox rather than achieving a full renderer or OS escape. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and CISA SSVC records no known exploitation.
Sandbox escape in Google Chrome's Skia graphics library affects all desktop Chrome builds prior to 150.0.7871.46, where a use-after-free (CWE-416) triggered by a crafted HTML page can let a remote attacker break out of the renderer sandbox. Google rates the Chromium severity Critical and CVSS is 9.6, but there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as none. A vendor patch is available in the June 2026 Stable channel release.
Sandbox escape in Google Chrome's Dawn (WebGPU) component affects all desktop builds prior to 150.0.7871.46, where a use-after-free lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity Critical, and the CVSS 3.1 score of 9.6 reflects a scope-changing memory-corruption bug. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is already shipping in the Stable channel.
Sandbox escape in Google Chrome on macOS (versions prior to 150.0.7871.46) stems from a use-after-free in Dawn, Chrome's WebGPU/graphics abstraction layer, and allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox and gain higher-privileged code execution on the host. The flaw is rated High by Chromium and carries a CVSS 9.6 due to its network attack vector, low complexity, and scope change. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and CISA's SSVC framework currently marks exploitation as 'none' though technical impact as 'total'.
Sandbox escape in Google Chrome's ANGLE graphics component affects all desktop builds prior to 150.0.7871.46, where a use-after-free condition lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Chromium rates the severity High and a fixed stable-channel build is available, but SSVC records no observed exploitation and no public exploit identified at time of analysis. The high CVSS (9.6) is driven by the scope change inherent to sandbox escape rather than confirmed real-world abuse.
Sandbox escape in Google Chrome's ANGLE graphics layer lets a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain code execution in a higher-privilege context. All Chrome desktop builds prior to 150.0.7871.46 are affected. Chromium rated the underlying use-after-free High severity; no public exploit has been identified at time of analysis and SSVC records exploitation status as none.
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 150.0.7871.46 lets a remote attacker break out of the renderer sandbox when a victim opens a crafted HTML page. Rated Critical by Chromium with a 9.6 CVSS score, the flaw is a use-after-free (CWE-416) requiring only that the target visit a malicious site. No public exploit or active exploitation is identified at time of analysis, and CISA's SSVC assessment lists exploitation as none.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that lets an authorized attacker run arbitrary code over a network within the browser process. Microsoft has shipped an official fix and rates it CVSS 8.3; the exploit-maturity metric is Unproven (E:U), meaning no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high to confidentiality and integrity with partial availability loss, making it a meaningful but not emergency patch priority for Edge-based endpoints.
Denial of service in NVIDIA Triton Inference Server for Linux (versions through 26.03) allows a remote attacker to crash the service by triggering a use-after-free (CWE-416) condition, per the NVIDIA product-security advisory. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) indicates network-reachable, unauthenticated exploitation with high availability impact but no confidentiality or integrity effect. No public exploit identified at time of analysis, and CISA SSVC rates exploitation status as 'none' with an EPSS of 0.54% (41st percentile), consistent with no observed activity.
Use-after-free race condition in the Linux kernel's fhandle subsystem, where may_decode_fh() reads mount::mnt_ns without RCU protection, allowing a concurrently-unmounted mount namespace to be freed and dereferenced during an open_by_handle_at() call. The affected code path is reachable only when the mount was created via open_tree(OPEN_TREE_CLONE) and the kernel is built with CONFIG_PREEMPTION or CONFIG_RCU_STRICT_GRACE_PERIOD. Per the upstream fix note, real-world impact is limited to a kernel crash (DoS), an endless loop, or a minor information leak (the result of a capability level comparison); there is no public exploit identified at time of analysis and EPSS probability is very low at 0.15%.
Remote code execution in Google Chrome on Linux prior to 150.0.7871.47 stems from a use-after-free in the Audio component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the renderer. The CVSS 8.8 rating reflects network reach with required user interaction (visiting a page), yet Chromium rated the security severity only Low and SSVC shows no observed exploitation. No public exploit is identified at time of analysis and EPSS is low at 0.24% (15th percentile).
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Linux, fixed in 150.0.7871.47, lets a remote attacker corrupt memory via crafted network traffic and potentially run arbitrary code. The flaw is a CWE-416 use-after-free reported by Google's internal Chrome security team; there is no public exploit identified at time of analysis and it is not in CISA KEV. Note a signal conflict: NVD scores this 9.8 (Critical) while Chromium itself rated the security severity 'Low', and EPSS is only 0.20% (10th percentile).
Sandbox escape in Google Chrome for Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process abuse a use-after-free in the Updater component via a crafted HTML page to break out of the browser sandbox. It is a second-stage bug that Chromium rated only Low severity despite the CVSS 9.6 score, with no public exploit identified at time of analysis and a low EPSS probability of 0.18% (8th percentile). Google has shipped a fixed Stable-channel build.
Arbitrary code execution in Google Chrome's WebProtect component (versions prior to 150.0.7871.47) arises from a use-after-free (CWE-416) that a malicious Chrome extension can trigger to run attacker-controlled code. Exploitation is gated behind convincing a victim to install a crafted extension, and Chromium rated the security severity as Low despite the NVD CVSS of 8.1. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile).
Sandboxed remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 150.0.7871.47) lets a remote attacker corrupt memory via a crafted PDF, triggering a use-after-free (CWE-416). Exploitation requires the victim to open or view a malicious PDF (UI:R), and per the description any resulting code execution occurs inside the browser sandbox, which meaningfully constrains impact absent a separate sandbox-escape. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and CISA SSVC records exploitation status as none.
Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Scheduling component, letting a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.21% (12th percentile). Google rates the Chromium security severity as Low despite the NVD CVSS of 8.8, reflecting that code execution is confined to the sandbox rather than the host.
Heap corruption via use-after-free in Google Chrome's Passwords component affects all desktop builds prior to 150.0.7871.47, letting a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and code execution in the renderer. The CVSS 3.1 vector (8.8) requires user interaction (visiting the page) but no privileges or authentication. No public exploit identified at time of analysis, and the low EPSS score (0.17%, 7th percentile) plus Chromium's own 'Low' severity rating suggest limited real-world exploitation likelihood despite the high CVSS.
Heap corruption via use-after-free affects Google Chrome for iOS prior to 150.0.7871.47, where a remote attacker serving a crafted HTML page can trigger memory corruption after luring the victim into performing specific UI gestures. Chromium rated the issue Low severity, and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile) and CISA SSVC records no known exploitation. A vendor patch is available, so the practical priority is routine browser-update hygiene rather than emergency response.
OS-level privilege escalation in Google Chrome's Windows installer component (versions prior to 150.0.7871.47) lets a local attacker execute code at elevated privilege by planting a malicious file that triggers a use-after-free during installation. Google rates the Chromium security severity as Low, and while a vendor patch is available there is no public exploit identified at time of analysis; EPSS is very low (0.11%, 2nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 7.8 reflects total technical impact if triggered, but exploitation requires local access, user interaction, and Windows-specific installer conditions.
Sandbox escape in Google Chrome's Cast component (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory-corruption bug. Google's Chromium team rated the security severity as Low, and while NVD assigns a 9.6 CVSS reflecting full sandbox-escape impact, exploitation is gated behind a pre-existing renderer compromise. No public exploit was identified at time of analysis, EPSS is very low at 0.17% (7th percentile), and there is no CISA KEV listing.
Sandbox-contained arbitrary code execution in Google Chrome (Chromium DevTools component) before version 150.0.7871.47 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416); Google rated its Chromium security severity as Low because execution is confined to the sandbox rather than the host OS. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and CISA SSVC lists exploitation as none - but a vendor patch is already available in the Stable channel.
Remote code execution in Google Chrome for iOS prior to 150.0.7871.47 stems from a use-after-free (CWE-416) that a remote attacker can trigger when a victim loads a crafted HTML page. Despite Chromium rating the underlying bug 'Low' severity, the NVD CVSS scores it 8.8 (High) because successful exploitation yields full compromise of the browser process. There is no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile), with CISA SSVC recording no observed exploitation.
Remote code execution in Google Chrome for Android prior to 150.0.7871.47 stems from a use-after-free in the PageInfo component, allowing a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser process. Chromium rated the security severity Low, and while the CVSS base score is 7.5, the high attack complexity and required user interaction constrain practical exploitation. No public exploit identified at time of analysis, and the EPSS score is low at 0.21% (12th percentile).
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and is second-stage: it is not directly exploitable from the open web without a prior renderer compromise. No public exploit has been identified at time of analysis, and its EPSS exploitation probability is low (0.17%, 7th percentile); notably, Google rated the Chromium security severity as Low despite the NVD CVSS of 9.6.
Sandbox escape in Google Chrome's GetUserMedia (media capture) implementation before version 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own security team; despite an NVD CVSS of 9.6, Chromium rates its severity Low, and there is no public exploit identified at time of analysis with an EPSS of only 0.17% (7th percentile).
Heap corruption in Google Chrome's BrowserTag component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by a crafted Chrome extension. An attacker who convinces a victim to install a malicious extension can potentially exploit the freed-memory condition to corrupt the heap and execute code. No public exploit identified at time of analysis, and EPSS is low (0.12%, 2nd percentile), consistent with the Chromium team's own 'Low' severity rating despite the NVD CVSS of 8.8.
Arbitrary code execution in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, triggerable by a crafted Chrome Extension. An attacker who convinces a user to install a malicious extension can corrupt memory to run code in the browser context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.13% (3rd percentile), and CISA SSVC records exploitation status as none.
Use-after-free in Google Chrome's SignIn component (versions prior to 150.0.7871.47) allows a remote attacker to trigger heap corruption and potentially achieve code execution after luring a victim to a crafted HTML page and performing specific UI gestures. No public exploit was identified at time of analysis, and with an EPSS of 0.17% (7th percentile) and Chromium-rated 'Low' severity, near-term mass exploitation appears unlikely despite the high 8.8 CVSS. The flaw is patched in the current stable channel and is not listed in CISA KEV.
Heap corruption in Google Chrome's Views UI framework on macOS (versions before 150.0.7871.47) lets a remote attacker who lures a victim to a crafted HTML page and coaxes them into specific UI gestures trigger a use-after-free, potentially achieving code execution in the renderer. Google rates the Chromium severity as Low, but the NVD CVSS is 8.8 (High), and no public exploit has been identified at time of analysis. EPSS is low at 0.21% (11th percentile), and the flaw is not in CISA KEV.
Use-after-free in Google Chrome's Ozone component on Linux prior to 150.0.7871.47 lets a remote attacker trigger heap corruption after luring a user to a crafted HTML page and inducing specific UI gestures. Rated CVSS 8.8 with high confidentiality, integrity and availability impact, it is patched in the stable channel but requires user interaction (UI:R). No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile), and Google classifies the Chromium severity as Medium.
Local privilege escalation in Google Chrome's Updater component on Windows (versions prior to 150.0.7871.47) allows a local attacker to escalate to OS-level privileges via a malicious file that triggers a use-after-free condition. Google rates the Chromium security severity as Medium, though the CVSS base score is 7.8 (High) because the Updater runs with elevated (SYSTEM) privileges. There is no public exploit identified at time of analysis and EPSS is very low (0.11%, 1st percentile), indicating negligible observed exploitation activity.
Remote code execution in Google Chrome (Desktop) before 150.0.7871.47 stems from a use-after-free in the Navigation component, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt memory and run arbitrary code in the renderer. Chromium rated it Medium, but the CVSS 8.8 reflects full C/I/A impact requiring only user interaction (visiting a page). There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, with a low EPSS of 0.21%.
Use-after-free in Google Chrome's Omnibox component on Android (versions prior to 150.0.7871.47) lets a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page trigger heap corruption and potentially achieve code execution in the renderer. Rated Medium by Chromium but scored CVSS 8.8 due to network reach and full CIA impact after minimal user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.17%), and SSVC records exploitation status as none.
Arbitrary code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in Oilpan, Blink's garbage collector, letting a remote attacker who lures a victim to a crafted HTML page run code within the renderer sandbox. Google rated it Medium severity; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). Google has shipped a fixed Stable-channel build, and exploitation requires user interaction (visiting a malicious page).
Use-after-free memory corruption in Google Chrome for iOS before version 150.0.7871.47 allows a remote attacker to trigger heap corruption when a victim loads a crafted HTML page, potentially leading to code execution within the browser context. The flaw was reported by Google's own security team and carries an NVD CVSS of 8.8, though Chromium rated its severity as Medium, and no public exploit has been identified at time of analysis. EPSS is low (0.21%, 11th percentile) and CISA SSVC records no observed exploitation, indicating this is a patch-on-schedule issue rather than an active threat.
Heap corruption in Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who lures a user through specific in-page UI gestures on a crafted HTML page trigger a use-after-free (CWE-416), potentially leading to arbitrary code execution in the renderer. Rated Medium by the Chromium security team but scored CVSS 8.8 due to full confidentiality/integrity/availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.21% (11th percentile), consistent with a freshly patched browser bug that has no known weaponization.
Remote code execution in Google Chrome prior to 150.0.7871.47 stems from a use-after-free (CWE-416) in the browser's HTML handling, letting a remote attacker who lures a victim to a crafted page execute arbitrary code, though execution is confined inside Chrome's renderer sandbox. Chromium rated the issue Medium severity precisely because the code runs within the sandbox rather than escaping it; no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) with SSVC exploitation status 'none'. Google has shipped a fixed Stable-channel build.
Sandboxed remote code execution in Google Chrome's Cast Receiver component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by luring a victim to a crafted HTML page. Google rates the Chromium severity as Medium because the resulting code execution is confined to the browser sandbox, though NVD scores it CVSS 8.8; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.27% (18th percentile).
Use-after-free in the Extensions component of Google Chrome before 150.0.7871.47 lets a remote attacker execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Chromium rated the security severity Medium, though the associated CVSS score is 8.8 (High) due to network vector and high impact; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.26%. Google has shipped a fixed Stable channel build.
Sandboxed remote code execution in Google Chrome for Android before 150.0.7871.47, stemming from a use-after-free in the Skia graphics library, lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google rated the Chromium security severity as Medium, and no public exploit has been identified at time of analysis; the EPSS score is low (0.26%, 17th percentile), and the bug is not on CISA KEV. Exploitation requires user interaction (visiting the malicious page) but no authentication.
Sandbox escape in Google Chrome's USB subsystem on macOS (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and was reported by Google's own security team; Chromium rated it Medium severity despite the NVD CVSS of 9.6. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 11th percentile), consistent with a chained/second-stage bug rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, letting an attacker who has already compromised the renderer process break out of the sandbox and reach the higher-privileged browser process via a crafted HTML page. This is a second-stage exploitation primitive rather than an initial-access flaw, which is why Google rates the Chromium severity as Medium despite the 9.6 CVSS. No public exploit has been identified, there is no CISA KEV listing, and EPSS exploitation probability is low (0.21%, 11th percentile).
Sandboxed remote code execution in the WebView component of Google Chrome for Android before 150.0.7871.47 lets a remote attacker run arbitrary code within the renderer sandbox when a victim loads a crafted HTML page. Rated CVSS 8.8 (network vector, no privileges, requires user interaction), the flaw is a CWE-416 use-after-free, but code execution is confined to the sandbox and would require a separate escape to reach the host. No public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile), indicating limited near-term mass-exploitation pressure despite the high base score.
Sandbox escape in Google Chrome's Device component on Windows (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416). Google rates the Chromium security severity as Medium, reflecting that it is a second-stage bug requiring prior renderer compromise, though the NVD CVSS of 9.6 is inflated by the sandbox scope change. There is no public exploit identified at time of analysis and EPSS is low (0.21%), indicating no current sign of widespread exploitation.
Sandbox escape in Google Chrome before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page, exploiting a use-after-free (CWE-416) in the Core component. Google-assigned Chromium severity is Medium, though the NVD CVSS is 9.6 due to the cross-boundary scope change. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), indicating it is not yet a mass-exploitation target.
Remote code execution in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in the Ozone platform layer, allowing a remote attacker who lures a victim into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser context. Rated High by Chromium and CVSS 7.5, exploitation is gated by required user interaction and high attack complexity. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.26% (17th percentile).
Sandbox escape in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in Ozone, Chrome's platform abstraction layer for windowing and graphics. An attacker who has already compromised the renderer process can leverage a crafted HTML page to break out of the browser sandbox and gain code execution at the higher-privileged browser-process level. There is no public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a second-stage bug that requires a prior renderer compromise rather than a directly weaponizable single-shot flaw.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Journeys (browsing history) component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader code execution on the host via a crafted HTML page. Rated High severity by Chromium and CVSS 9.6, a fix is available from vendor; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Exploitation is meaningful only as the second stage of a chain, since it presupposes prior renderer compromise.
Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Forms component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser's renderer sandbox. Chromium rates the flaw High severity, CVSS 8.8, requiring only that the user visit a malicious page; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). A vendor patch is available in the June 2026 Stable channel release.
Sandbox escape in Google Chrome for macOS before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a use-after-free in the USB subsystem via a crafted HTML page. Rated High by Chromium and CVSS 9.6, it functions as a second-stage escalation primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Arbitrary code execution in Google Chrome's DOM implementation lets a remote attacker run code within the renderer sandbox by luring a victim to a crafted HTML page. All desktop Chrome builds before 150.0.7871.47 are affected; Chromium rates the flaw High severity. No public exploit has been identified and EPSS probability is low (0.26%), but the vendor patch is already available and should be applied promptly.
Local OS-level privilege escalation in Google Chrome on Windows (versions prior to 150.0.7871.47) arises from a use-after-free in the Chrome Updater component, letting a local attacker who can plant a malicious file on the system elevate to higher OS privileges. Google rates the Chromium severity as High and has released a fixed Stable channel build; there is no public exploit identified and it is not listed in CISA KEV. EPSS is low at 0.13% (3rd percentile), consistent with a bug that requires local access and user interaction rather than mass remote exploitation.
Sandbox escape in Google Chrome's Headless component (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page. Rated High by Chromium and CVSS 8.3, it is a CWE-416 use-after-free with no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and CISA SSVC records no known exploitation.
Out-of-bounds read/write (use-after-free) in Google Chrome's GPU component lets a remote attacker who has already compromised the renderer process run arbitrary code - though still confined inside the sandbox - by serving a crafted HTML page to a Chrome build prior to 150.0.7871.47. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and EPSS puts near-term exploitation probability at just 0.26%.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Linux allows an adjacent-network attacker to run arbitrary code by sending malicious network traffic to a vulnerable client before version 150.0.7871.47. The flaw is a use-after-free memory-corruption issue rated High by Chromium and carries a CVSS 8.8. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.24%, 15th percentile), indicating no observed exploitation activity yet.
Local privilege escalation in Google Chrome's Updater component on macOS versions prior to 150.0.7871.47 lets an attacker abuse a use-after-free (CWE-416) via a malicious file to gain the elevated privileges under which the updater runs. Google rates the Chromium severity as High, and the CVSS 3.1 base score is 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.13% (3rd percentile), consistent with the SSVC exploitation status of 'none'.
Sandbox escape in Google Chrome's Glic component before version 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Rated High by Chromium with a CVSS of 8.3 and a scope-changing vector; there is no public exploit identified at time of analysis, and EPSS is low at 0.21%. SSVC shows no known exploitation and Google has released a patched Stable channel build.
Remote code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in the Canvas component, letting a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a malicious page), but no authentication. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).
Remote code execution in Google Chrome's Blink rendering engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and 8.8 (CVSS 3.1); it requires user interaction (visiting a malicious page) and no privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.26% (17th percentile).
Heap corruption via a use-after-free in the Views UI component of Google Chrome allows a remote attacker who serves a crafted HTML page and lures a user into performing specific UI gestures to potentially execute code in the browser process. All desktop Chrome builds prior to 150.0.7871.47 are affected; Google rates the Chromium severity as High and has shipped a fix. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Renderer-process remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Input Method Editor (IME) component, letting a remote attacker run arbitrary code within the browser's sandbox when a victim visits a crafted HTML page. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a page) but no authentication. No public exploit identified at time of analysis, and the EPSS score is low (0.26%, 17th percentile), indicating no evidence of widespread exploitation yet.
Remote code execution in Google Chrome on iOS prior to 150.0.7871.47 stems from a use-after-free in the browser's Import component, allowing a remote attacker who lures a victim into opening a malicious file and performing specific UI gestures to execute arbitrary code. Rated High by Chromium and CVSS 7.5, the flaw has no public exploit identified at time of analysis and a low EPSS of 0.24% (15th percentile), consistent with its high attack complexity and required user interaction. A vendor patch is available in the June 2026 Stable channel update.
Remote code execution in Google Chrome for macOS prior to 150.0.7871.47 stems from a use-after-free in the GFX (graphics) component, allowing a remote attacker to run arbitrary code after a victim opens a crafted HTML page. Chromium rates the severity High and the CVSS is 8.8, but exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and EPSS is low (0.26%, 17th percentile), indicating no observed weaponization yet.
Sandbox escape in Google Chrome's Chromecast component (versions before 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page. Rooted in a use-after-free (CWE-416) memory-corruption bug rated High by Chromium, it carries a CVSS 8.3 driven by a scope change and full CIA impact, but requires a pre-existing renderer compromise, high attack complexity, and user interaction. No public exploit identified at time of analysis, and the low EPSS (0.21%) plus SSVC 'exploitation: none' indicate it is not currently being exploited.
Remote code execution in Google Chrome (Views UI component) prior to 150.0.7871.47 allows a remote attacker to execute arbitrary code by luring a victim to a crafted HTML page and inducing specific UI gestures that trigger a use-after-free. Rated High by Chromium and CVSS 7.5, the flaw is elevated in complexity by its requirement for user interaction, and no public exploit has been identified at time of analysis; EPSS probability is low at 0.26%.
Heap corruption in Google Chrome's QUIC networking stack (versions prior to 150.0.7871.47) stems from a use-after-free that a remote attacker can trigger through crafted network traffic, potentially leading to arbitrary code execution in the affected browser process. Google rated the Chromium security severity as High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as 'none'. EPSS is low (0.19%, 9th percentile), indicating no observed weaponization despite a total technical-impact rating.
Sandbox escape in Google Chrome for macOS versions prior to 150.0.7871.47 stems from a use-after-free in the Touchbar component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Reported through Google's internal Chrome security process and rated High by Chromium, it carries a CVSS 9.6 due to scope change and full CIA impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.21%. SSVC assesses current exploitation as none, indicating this is a patch-now-but-not-panic item.
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4, ≤13.2.4, ≤2026.1.1) and Foxit PDF Reader (≤2026.1.1) allows an attacker to corrupt object state and read an illegal memory address when a victim opens a crafted PDF that manipulates form-field properties via embedded JavaScript. The immediate observed impact is an application crash (denial of service), but the CWE-416 root cause and the vendor's CVSS confidentiality/integrity ratings indicate potential for arbitrary code execution in the context of the user. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Use-after-free memory corruption in Foxit PDF Editor (≤14.0.4) and Foxit PDF Reader (≤2026.1.1) allows a crafted PDF containing malicious form-reset JavaScript to trigger a stale control-pointer dereference, crashing the application and potentially enabling arbitrary code execution in the victim's context. Exploitation requires the user to open a booby-trapped document; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Foxit, the reporting vendor, has issued a security bulletin covering the affected versions.
Use-after-free during PDF field processing in Foxit PDF Editor and Foxit PDF Reader allows a crafted document to delete the current page and then reuse now-dangling field objects, causing an illegal memory read and application crash. Affects Foxit PDF Editor through 14.0.4 / 2026.1.1 and Foxit PDF Reader through 2026.1.1; exploitation requires a user to open a malicious PDF. No public exploit identified at time of analysis and the flaw is not in CISA KEV; vendor (Foxit) reported it and tags it primarily as denial of service / memory corruption.
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader is triggered when JavaScript embedded in a malicious PDF resets form fields and re-enters the interface, causing the application to invoke a method on a freed native object. An attacker who convinces a user to open a crafted PDF can crash the application, and because the flaw is a use-after-free (CWE-416), it carries potential for memory-corruption abuse beyond denial of service. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows a crafted PDF containing embedded JavaScript to trigger a use-after-free (CWE-416) when the script manipulates a list box field and the form is subsequently reset. A victim who merely opens the malicious document can have the application dereference a dangling pointer to freed form-field memory; Foxit itself reported the flaw and CVSS rates it 7.8. No public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis, though use-after-free in a scriptable PDF engine is a classic path toward code execution.
Use-after-free in the GLX dispatch layer of X.Org X Server and Xwayland allows an authenticated X client to corrupt heap memory by triggering a contextTags array reallocation while a stale pointer is still held. The attacker crafts a deterministic sequence of exactly 34 GLX requests - 17 CreateContext and 17 MakeCurrent calls - to force the realloc, after which GlxFreeContextTag writes zeros into freed memory at five fixed offsets. No CVSS vector or KEV listing is present; the vulnerability was discovered by an anonymous researcher through Trend Micro Zero Day Initiative (ZDI-CAN-30561), indicating active vulnerability research interest though no public exploit has been confirmed.
Memory corruption in the OpenSSH client (ssh) before 10.4 lets a malicious or compromised SSH server trigger a use-after-free on the connecting client by changing its host key during a key re-exchange (rekey), potentially leading to information disclosure or code execution in the client process. Only the client side is affected; the server is not vulnerable. There is no public exploit identified at time of analysis and it is not on CISA KEV, and EPSS is low (0.25%, 16th percentile), but the flaw is fixed in OpenSSH 10.4/10.4p1.
Arbitrary code execution in an unnamed ICS/OT application arises from a use-after-free (CWE-416) triggered when the software parses a specially crafted file, letting an attacker run code in the context of the current process. The flaw was reported through CISA's ICS-CERT (advisory ICSA-26-188-06) and carries a CVSS 4.0 base score of 8.4; exploitation is local and requires a user to open the malicious file. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation and host memory corruption in the Linux kernel's KVM x86 shadow paging (MMU) subsystem allows a low-privileged actor with control over a guest/VMM to trigger a use-after-free in the host kernel. The flaw is an incomplete fix for commit 0cb2af2ea66ad: kvm_mmu_get_child_sp() reuses a shadow page without comparing its role, so a stale rmap entry survives after a memslot is dropped and the shadow page is freed, and later gfn walks dereference a pointer into freed memory. A public proof-of-concept exists (flagged by Italy's ACN/CSIRT) and SSVC rates technical impact as total, but it is not on CISA KEV and EPSS is low (0.18%), indicating no confirmed widespread active exploitation.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that an unauthorized, remote attacker can trigger to run arbitrary code. Exploitation requires the victim to interact with attacker-controlled web content, and the CVSS 3.1 vector marks high attack complexity (AC:H) despite requiring no privileges (PR:N). Microsoft has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that an unauthenticated, network-based attacker can trigger to run arbitrary code in the browser process. Exploitation requires the victim to interact — typically by visiting a malicious or compromised web page — and the CVSS 3.1 score of 8.3 reflects high attack complexity plus a scope change consistent with a renderer sandbox escape. There is no public exploit identified at time of analysis and no CISA KEV listing, though the underlying Chromium engine origin (tags reference Google) means a shared upstream root cause across Chromium browsers is likely.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) that an unauthorized network attacker can trigger to run arbitrary code in the browser process. Exploitation requires the victim to interact with attacker-controlled content (UI:R) and involves high attack complexity (AC:H), so a user must be lured to a malicious or compromised page. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; Microsoft has released a fix.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory-corruption bug (CWE-416) that an unauthorized attacker can trigger over the network to run arbitrary code in the browser's context. Exploitation requires the victim to interact with attacker-controlled web content and the CVSS vector flags high attack complexity, so successful attacks are not trivial. There is no public exploit identified at time of analysis and no CISA KEV listing, but a vendor patch is available from Microsoft.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) that lets an unauthenticated attacker run arbitrary code when a victim visits a malicious web page. All Edge Chromium versions prior to the vendor-patched build are affected, and the CVSS 3.1 base score is 8.8 (High). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation requires user interaction such as browsing to attacker-controlled content.
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthorized attacker to run arbitrary code when a victim views attacker-controlled web content, stemming from a use-after-free memory-corruption flaw (CWE-416). The scope-changed CVSS vector (S:C) indicates the bug can breach the browser's sandbox boundary. Microsoft has released a fix; there is no public exploit identified at time of analysis (CVSS E:U) and it is not listed in CISA KEV.
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated attacker run arbitrary code when a victim is lured into loading attacker-controlled web content that triggers a use-after-free memory corruption. The flaw carries a CVSS 3.1 base of 7.5 and requires user interaction, and the CVSS temporal metrics (E:U, RL:O, RC:C) indicate the issue is confirmed and officially patched with no public exploit identified at time of analysis. Because Edge shares Chromium's rendering engine, the underlying defect is likely rooted in an upstream Chromium/Blink component (the intel tags also reference Google).
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that an unauthenticated attacker can trigger over the network when a victim loads attacker-controlled web content. Microsoft has released an official fix and rates the issue 7.5 (High), tempered by high attack complexity and required user interaction; the CVSS temporal data marks exploit maturity as Unproven (E:U), so there is no public exploit identified at time of analysis and no CISA KEV listing. The vendor tags ('Google', 'Use After Free', 'Denial Of Service') indicate this most likely tracks an upstream Chromium engine defect inherited by Edge.
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticates against an external LDAP server. A race condition in the IKEv2 LDAP authentication path can be driven into a use-after-free (CWE-416) inside the iked daemon, letting a remote unauthenticated attacker execute arbitrary code in the context of that process. No public exploit identified at time of analysis, and the CVSS 4.0 base score of 9.2 is tempered by high attack complexity and a probabilistic attack requirement (AC:H/AT:P), reflecting the difficulty of reliably winning the race.
Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem lets a local unprivileged process corrupt kernel memory by racing a listening-socket close against a concurrent HCI disconnect. When l2cap_sock_cleanup_listen() walks not-yet-accepted child sockets while hci_rx_work drives l2cap_conn_del() to free those same child sockets and their l2cap_chan, cleanup_listen() dereferences freed objects, yielding a KASAN slab-use-after-free that can crash the host or enable further memory-corruption primitives. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV, but the vendor confirmed reproducibility (12 UAF reports per run before the fix).
Arbitrary code execution in the V8 JavaScript engine of Google Chrome prior to 150.0.7871.46 lets a remote attacker run code inside the renderer sandbox after luring a victim to a crafted HTML page and getting them to perform specific UI gestures. Rated High by Chromium, it carries CVSS 7.5 (AC:H/UI:R) reflecting the required user interaction and attack complexity. There is no public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), consistent with SSVC exploitation status of 'none'.
Remote code execution risk in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.46) arises from a use-after-free that a remote attacker can trigger by luring a victim to a crafted HTML page, leading to heap corruption and potential arbitrary code execution in the renderer. The CVSS 8.8 rating reflects high impact with only user interaction (visiting a page) required, though Google rated the Chromium security severity as Low and no public exploit is identified at time of analysis. EPSS is low at 0.18% (8th percentile) and CISA SSVC records no known exploitation.
Use-after-free in Chrome's V8 JavaScript engine (versions before 150.0.7871.46) lets a remote attacker achieve arbitrary code execution inside the renderer sandbox by luring a victim to a crafted HTML page. Chromium rated this Medium severity, but the CVSS 8.8 reflects high confidentiality, integrity, and availability impact requiring only a single user click; there is no public exploit identified at time of analysis and CISA's SSVC framework records no known exploitation. Because scope is unchanged (S:U), code execution is confined to the sandbox and does not by itself constitute a full host compromise.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.46) allows an attacker to run arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; Chromium rated it Medium severity while NVD assigns CVSS 8.8. No public exploit has been identified at time of analysis, and CISA's SSVC framework records exploitation status as 'none'.
Arbitrary code execution within the V8 sandbox affects Google Chrome desktop builds prior to 150.0.7871.46, where a use-after-free in the V8 JavaScript engine lets a remote attacker run code inside the sandbox when a victim opens a crafted HTML page. Google internally rated the Chromium security severity as Low and the execution is contained to the V8 sandbox rather than achieving a full renderer or OS escape. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and CISA SSVC records no known exploitation.
Sandbox escape in Google Chrome's Skia graphics library affects all desktop Chrome builds prior to 150.0.7871.46, where a use-after-free (CWE-416) triggered by a crafted HTML page can let a remote attacker break out of the renderer sandbox. Google rates the Chromium severity Critical and CVSS is 9.6, but there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as none. A vendor patch is available in the June 2026 Stable channel release.
Sandbox escape in Google Chrome's Dawn (WebGPU) component affects all desktop builds prior to 150.0.7871.46, where a use-after-free lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity Critical, and the CVSS 3.1 score of 9.6 reflects a scope-changing memory-corruption bug. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is already shipping in the Stable channel.
Sandbox escape in Google Chrome on macOS (versions prior to 150.0.7871.46) stems from a use-after-free in Dawn, Chrome's WebGPU/graphics abstraction layer, and allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox and gain higher-privileged code execution on the host. The flaw is rated High by Chromium and carries a CVSS 9.6 due to its network attack vector, low complexity, and scope change. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and CISA's SSVC framework currently marks exploitation as 'none' though technical impact as 'total'.
Sandbox escape in Google Chrome's ANGLE graphics component affects all desktop builds prior to 150.0.7871.46, where a use-after-free condition lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Chromium rates the severity High and a fixed stable-channel build is available, but SSVC records no observed exploitation and no public exploit identified at time of analysis. The high CVSS (9.6) is driven by the scope change inherent to sandbox escape rather than confirmed real-world abuse.
Sandbox escape in Google Chrome's ANGLE graphics layer lets a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain code execution in a higher-privilege context. All Chrome desktop builds prior to 150.0.7871.46 are affected. Chromium rated the underlying use-after-free High severity; no public exploit has been identified at time of analysis and SSVC records exploitation status as none.
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 150.0.7871.46 lets a remote attacker break out of the renderer sandbox when a victim opens a crafted HTML page. Rated Critical by Chromium with a 9.6 CVSS score, the flaw is a use-after-free (CWE-416) requiring only that the target visit a malicious site. No public exploit or active exploitation is identified at time of analysis, and CISA's SSVC assessment lists exploitation as none.
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that lets an authorized attacker run arbitrary code over a network within the browser process. Microsoft has shipped an official fix and rates it CVSS 8.3; the exploit-maturity metric is Unproven (E:U), meaning no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high to confidentiality and integrity with partial availability loss, making it a meaningful but not emergency patch priority for Edge-based endpoints.
Denial of service in NVIDIA Triton Inference Server for Linux (versions through 26.03) allows a remote attacker to crash the service by triggering a use-after-free (CWE-416) condition, per the NVIDIA product-security advisory. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) indicates network-reachable, unauthenticated exploitation with high availability impact but no confidentiality or integrity effect. No public exploit identified at time of analysis, and CISA SSVC rates exploitation status as 'none' with an EPSS of 0.54% (41st percentile), consistent with no observed activity.
Use-after-free race condition in the Linux kernel's fhandle subsystem, where may_decode_fh() reads mount::mnt_ns without RCU protection, allowing a concurrently-unmounted mount namespace to be freed and dereferenced during an open_by_handle_at() call. The affected code path is reachable only when the mount was created via open_tree(OPEN_TREE_CLONE) and the kernel is built with CONFIG_PREEMPTION or CONFIG_RCU_STRICT_GRACE_PERIOD. Per the upstream fix note, real-world impact is limited to a kernel crash (DoS), an endless loop, or a minor information leak (the result of a capability level comparison); there is no public exploit identified at time of analysis and EPSS probability is very low at 0.15%.
Remote code execution in Google Chrome on Linux prior to 150.0.7871.47 stems from a use-after-free in the Audio component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the renderer. The CVSS 8.8 rating reflects network reach with required user interaction (visiting a page), yet Chromium rated the security severity only Low and SSVC shows no observed exploitation. No public exploit is identified at time of analysis and EPSS is low at 0.24% (15th percentile).
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Linux, fixed in 150.0.7871.47, lets a remote attacker corrupt memory via crafted network traffic and potentially run arbitrary code. The flaw is a CWE-416 use-after-free reported by Google's internal Chrome security team; there is no public exploit identified at time of analysis and it is not in CISA KEV. Note a signal conflict: NVD scores this 9.8 (Critical) while Chromium itself rated the security severity 'Low', and EPSS is only 0.20% (10th percentile).
Sandbox escape in Google Chrome for Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process abuse a use-after-free in the Updater component via a crafted HTML page to break out of the browser sandbox. It is a second-stage bug that Chromium rated only Low severity despite the CVSS 9.6 score, with no public exploit identified at time of analysis and a low EPSS probability of 0.18% (8th percentile). Google has shipped a fixed Stable-channel build.
Arbitrary code execution in Google Chrome's WebProtect component (versions prior to 150.0.7871.47) arises from a use-after-free (CWE-416) that a malicious Chrome extension can trigger to run attacker-controlled code. Exploitation is gated behind convincing a victim to install a crafted extension, and Chromium rated the security severity as Low despite the NVD CVSS of 8.1. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile).
Sandboxed remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 150.0.7871.47) lets a remote attacker corrupt memory via a crafted PDF, triggering a use-after-free (CWE-416). Exploitation requires the victim to open or view a malicious PDF (UI:R), and per the description any resulting code execution occurs inside the browser sandbox, which meaningfully constrains impact absent a separate sandbox-escape. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and CISA SSVC records exploitation status as none.
Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Scheduling component, letting a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.21% (12th percentile). Google rates the Chromium security severity as Low despite the NVD CVSS of 8.8, reflecting that code execution is confined to the sandbox rather than the host.
Heap corruption via use-after-free in Google Chrome's Passwords component affects all desktop builds prior to 150.0.7871.47, letting a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and code execution in the renderer. The CVSS 3.1 vector (8.8) requires user interaction (visiting the page) but no privileges or authentication. No public exploit identified at time of analysis, and the low EPSS score (0.17%, 7th percentile) plus Chromium's own 'Low' severity rating suggest limited real-world exploitation likelihood despite the high CVSS.
Heap corruption via use-after-free affects Google Chrome for iOS prior to 150.0.7871.47, where a remote attacker serving a crafted HTML page can trigger memory corruption after luring the victim into performing specific UI gestures. Chromium rated the issue Low severity, and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile) and CISA SSVC records no known exploitation. A vendor patch is available, so the practical priority is routine browser-update hygiene rather than emergency response.
OS-level privilege escalation in Google Chrome's Windows installer component (versions prior to 150.0.7871.47) lets a local attacker execute code at elevated privilege by planting a malicious file that triggers a use-after-free during installation. Google rates the Chromium security severity as Low, and while a vendor patch is available there is no public exploit identified at time of analysis; EPSS is very low (0.11%, 2nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 7.8 reflects total technical impact if triggered, but exploitation requires local access, user interaction, and Windows-specific installer conditions.
Sandbox escape in Google Chrome's Cast component (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory-corruption bug. Google's Chromium team rated the security severity as Low, and while NVD assigns a 9.6 CVSS reflecting full sandbox-escape impact, exploitation is gated behind a pre-existing renderer compromise. No public exploit was identified at time of analysis, EPSS is very low at 0.17% (7th percentile), and there is no CISA KEV listing.
Sandbox-contained arbitrary code execution in Google Chrome (Chromium DevTools component) before version 150.0.7871.47 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416); Google rated its Chromium security severity as Low because execution is confined to the sandbox rather than the host OS. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and CISA SSVC lists exploitation as none - but a vendor patch is already available in the Stable channel.
Remote code execution in Google Chrome for iOS prior to 150.0.7871.47 stems from a use-after-free (CWE-416) that a remote attacker can trigger when a victim loads a crafted HTML page. Despite Chromium rating the underlying bug 'Low' severity, the NVD CVSS scores it 8.8 (High) because successful exploitation yields full compromise of the browser process. There is no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile), with CISA SSVC recording no observed exploitation.
Remote code execution in Google Chrome for Android prior to 150.0.7871.47 stems from a use-after-free in the PageInfo component, allowing a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser process. Chromium rated the security severity Low, and while the CVSS base score is 7.5, the high attack complexity and required user interaction constrain practical exploitation. No public exploit identified at time of analysis, and the EPSS score is low at 0.21% (12th percentile).
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and is second-stage: it is not directly exploitable from the open web without a prior renderer compromise. No public exploit has been identified at time of analysis, and its EPSS exploitation probability is low (0.17%, 7th percentile); notably, Google rated the Chromium security severity as Low despite the NVD CVSS of 9.6.
Sandbox escape in Google Chrome's GetUserMedia (media capture) implementation before version 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own security team; despite an NVD CVSS of 9.6, Chromium rates its severity Low, and there is no public exploit identified at time of analysis with an EPSS of only 0.17% (7th percentile).
Heap corruption in Google Chrome's BrowserTag component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by a crafted Chrome extension. An attacker who convinces a victim to install a malicious extension can potentially exploit the freed-memory condition to corrupt the heap and execute code. No public exploit identified at time of analysis, and EPSS is low (0.12%, 2nd percentile), consistent with the Chromium team's own 'Low' severity rating despite the NVD CVSS of 8.8.
Arbitrary code execution in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, triggerable by a crafted Chrome Extension. An attacker who convinces a user to install a malicious extension can corrupt memory to run code in the browser context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.13% (3rd percentile), and CISA SSVC records exploitation status as none.
Use-after-free in Google Chrome's SignIn component (versions prior to 150.0.7871.47) allows a remote attacker to trigger heap corruption and potentially achieve code execution after luring a victim to a crafted HTML page and performing specific UI gestures. No public exploit was identified at time of analysis, and with an EPSS of 0.17% (7th percentile) and Chromium-rated 'Low' severity, near-term mass exploitation appears unlikely despite the high 8.8 CVSS. The flaw is patched in the current stable channel and is not listed in CISA KEV.
Heap corruption in Google Chrome's Views UI framework on macOS (versions before 150.0.7871.47) lets a remote attacker who lures a victim to a crafted HTML page and coaxes them into specific UI gestures trigger a use-after-free, potentially achieving code execution in the renderer. Google rates the Chromium severity as Low, but the NVD CVSS is 8.8 (High), and no public exploit has been identified at time of analysis. EPSS is low at 0.21% (11th percentile), and the flaw is not in CISA KEV.
Use-after-free in Google Chrome's Ozone component on Linux prior to 150.0.7871.47 lets a remote attacker trigger heap corruption after luring a user to a crafted HTML page and inducing specific UI gestures. Rated CVSS 8.8 with high confidentiality, integrity and availability impact, it is patched in the stable channel but requires user interaction (UI:R). No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile), and Google classifies the Chromium severity as Medium.
Local privilege escalation in Google Chrome's Updater component on Windows (versions prior to 150.0.7871.47) allows a local attacker to escalate to OS-level privileges via a malicious file that triggers a use-after-free condition. Google rates the Chromium security severity as Medium, though the CVSS base score is 7.8 (High) because the Updater runs with elevated (SYSTEM) privileges. There is no public exploit identified at time of analysis and EPSS is very low (0.11%, 1st percentile), indicating negligible observed exploitation activity.
Remote code execution in Google Chrome (Desktop) before 150.0.7871.47 stems from a use-after-free in the Navigation component, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt memory and run arbitrary code in the renderer. Chromium rated it Medium, but the CVSS 8.8 reflects full C/I/A impact requiring only user interaction (visiting a page). There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, with a low EPSS of 0.21%.
Use-after-free in Google Chrome's Omnibox component on Android (versions prior to 150.0.7871.47) lets a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page trigger heap corruption and potentially achieve code execution in the renderer. Rated Medium by Chromium but scored CVSS 8.8 due to network reach and full CIA impact after minimal user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.17%), and SSVC records exploitation status as none.
Arbitrary code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in Oilpan, Blink's garbage collector, letting a remote attacker who lures a victim to a crafted HTML page run code within the renderer sandbox. Google rated it Medium severity; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). Google has shipped a fixed Stable-channel build, and exploitation requires user interaction (visiting a malicious page).
Use-after-free memory corruption in Google Chrome for iOS before version 150.0.7871.47 allows a remote attacker to trigger heap corruption when a victim loads a crafted HTML page, potentially leading to code execution within the browser context. The flaw was reported by Google's own security team and carries an NVD CVSS of 8.8, though Chromium rated its severity as Medium, and no public exploit has been identified at time of analysis. EPSS is low (0.21%, 11th percentile) and CISA SSVC records no observed exploitation, indicating this is a patch-on-schedule issue rather than an active threat.
Heap corruption in Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who lures a user through specific in-page UI gestures on a crafted HTML page trigger a use-after-free (CWE-416), potentially leading to arbitrary code execution in the renderer. Rated Medium by the Chromium security team but scored CVSS 8.8 due to full confidentiality/integrity/availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.21% (11th percentile), consistent with a freshly patched browser bug that has no known weaponization.
Remote code execution in Google Chrome prior to 150.0.7871.47 stems from a use-after-free (CWE-416) in the browser's HTML handling, letting a remote attacker who lures a victim to a crafted page execute arbitrary code, though execution is confined inside Chrome's renderer sandbox. Chromium rated the issue Medium severity precisely because the code runs within the sandbox rather than escaping it; no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) with SSVC exploitation status 'none'. Google has shipped a fixed Stable-channel build.
Sandboxed remote code execution in Google Chrome's Cast Receiver component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by luring a victim to a crafted HTML page. Google rates the Chromium severity as Medium because the resulting code execution is confined to the browser sandbox, though NVD scores it CVSS 8.8; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.27% (18th percentile).
Use-after-free in the Extensions component of Google Chrome before 150.0.7871.47 lets a remote attacker execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Chromium rated the security severity Medium, though the associated CVSS score is 8.8 (High) due to network vector and high impact; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.26%. Google has shipped a fixed Stable channel build.
Sandboxed remote code execution in Google Chrome for Android before 150.0.7871.47, stemming from a use-after-free in the Skia graphics library, lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google rated the Chromium security severity as Medium, and no public exploit has been identified at time of analysis; the EPSS score is low (0.26%, 17th percentile), and the bug is not on CISA KEV. Exploitation requires user interaction (visiting the malicious page) but no authentication.
Sandbox escape in Google Chrome's USB subsystem on macOS (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and was reported by Google's own security team; Chromium rated it Medium severity despite the NVD CVSS of 9.6. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 11th percentile), consistent with a chained/second-stage bug rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, letting an attacker who has already compromised the renderer process break out of the sandbox and reach the higher-privileged browser process via a crafted HTML page. This is a second-stage exploitation primitive rather than an initial-access flaw, which is why Google rates the Chromium severity as Medium despite the 9.6 CVSS. No public exploit has been identified, there is no CISA KEV listing, and EPSS exploitation probability is low (0.21%, 11th percentile).
Sandboxed remote code execution in the WebView component of Google Chrome for Android before 150.0.7871.47 lets a remote attacker run arbitrary code within the renderer sandbox when a victim loads a crafted HTML page. Rated CVSS 8.8 (network vector, no privileges, requires user interaction), the flaw is a CWE-416 use-after-free, but code execution is confined to the sandbox and would require a separate escape to reach the host. No public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile), indicating limited near-term mass-exploitation pressure despite the high base score.
Sandbox escape in Google Chrome's Device component on Windows (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416). Google rates the Chromium security severity as Medium, reflecting that it is a second-stage bug requiring prior renderer compromise, though the NVD CVSS of 9.6 is inflated by the sandbox scope change. There is no public exploit identified at time of analysis and EPSS is low (0.21%), indicating no current sign of widespread exploitation.
Sandbox escape in Google Chrome before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page, exploiting a use-after-free (CWE-416) in the Core component. Google-assigned Chromium severity is Medium, though the NVD CVSS is 9.6 due to the cross-boundary scope change. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), indicating it is not yet a mass-exploitation target.
Remote code execution in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in the Ozone platform layer, allowing a remote attacker who lures a victim into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser context. Rated High by Chromium and CVSS 7.5, exploitation is gated by required user interaction and high attack complexity. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.26% (17th percentile).
Sandbox escape in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in Ozone, Chrome's platform abstraction layer for windowing and graphics. An attacker who has already compromised the renderer process can leverage a crafted HTML page to break out of the browser sandbox and gain code execution at the higher-privileged browser-process level. There is no public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a second-stage bug that requires a prior renderer compromise rather than a directly weaponizable single-shot flaw.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Journeys (browsing history) component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader code execution on the host via a crafted HTML page. Rated High severity by Chromium and CVSS 9.6, a fix is available from vendor; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Exploitation is meaningful only as the second stage of a chain, since it presupposes prior renderer compromise.
Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Forms component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser's renderer sandbox. Chromium rates the flaw High severity, CVSS 8.8, requiring only that the user visit a malicious page; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). A vendor patch is available in the June 2026 Stable channel release.
Sandbox escape in Google Chrome for macOS before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a use-after-free in the USB subsystem via a crafted HTML page. Rated High by Chromium and CVSS 9.6, it functions as a second-stage escalation primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Arbitrary code execution in Google Chrome's DOM implementation lets a remote attacker run code within the renderer sandbox by luring a victim to a crafted HTML page. All desktop Chrome builds before 150.0.7871.47 are affected; Chromium rates the flaw High severity. No public exploit has been identified and EPSS probability is low (0.26%), but the vendor patch is already available and should be applied promptly.
Local OS-level privilege escalation in Google Chrome on Windows (versions prior to 150.0.7871.47) arises from a use-after-free in the Chrome Updater component, letting a local attacker who can plant a malicious file on the system elevate to higher OS privileges. Google rates the Chromium severity as High and has released a fixed Stable channel build; there is no public exploit identified and it is not listed in CISA KEV. EPSS is low at 0.13% (3rd percentile), consistent with a bug that requires local access and user interaction rather than mass remote exploitation.
Sandbox escape in Google Chrome's Headless component (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page. Rated High by Chromium and CVSS 8.3, it is a CWE-416 use-after-free with no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and CISA SSVC records no known exploitation.
Out-of-bounds read/write (use-after-free) in Google Chrome's GPU component lets a remote attacker who has already compromised the renderer process run arbitrary code - though still confined inside the sandbox - by serving a crafted HTML page to a Chrome build prior to 150.0.7871.47. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and EPSS puts near-term exploitation probability at just 0.26%.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Linux allows an adjacent-network attacker to run arbitrary code by sending malicious network traffic to a vulnerable client before version 150.0.7871.47. The flaw is a use-after-free memory-corruption issue rated High by Chromium and carries a CVSS 8.8. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.24%, 15th percentile), indicating no observed exploitation activity yet.
Local privilege escalation in Google Chrome's Updater component on macOS versions prior to 150.0.7871.47 lets an attacker abuse a use-after-free (CWE-416) via a malicious file to gain the elevated privileges under which the updater runs. Google rates the Chromium severity as High, and the CVSS 3.1 base score is 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.13% (3rd percentile), consistent with the SSVC exploitation status of 'none'.
Sandbox escape in Google Chrome's Glic component before version 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Rated High by Chromium with a CVSS of 8.3 and a scope-changing vector; there is no public exploit identified at time of analysis, and EPSS is low at 0.21%. SSVC shows no known exploitation and Google has released a patched Stable channel build.
Remote code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in the Canvas component, letting a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a malicious page), but no authentication. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).
Remote code execution in Google Chrome's Blink rendering engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and 8.8 (CVSS 3.1); it requires user interaction (visiting a malicious page) and no privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.26% (17th percentile).
Heap corruption via a use-after-free in the Views UI component of Google Chrome allows a remote attacker who serves a crafted HTML page and lures a user into performing specific UI gestures to potentially execute code in the browser process. All desktop Chrome builds prior to 150.0.7871.47 are affected; Google rates the Chromium severity as High and has shipped a fix. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Renderer-process remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Input Method Editor (IME) component, letting a remote attacker run arbitrary code within the browser's sandbox when a victim visits a crafted HTML page. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a page) but no authentication. No public exploit identified at time of analysis, and the EPSS score is low (0.26%, 17th percentile), indicating no evidence of widespread exploitation yet.
Remote code execution in Google Chrome on iOS prior to 150.0.7871.47 stems from a use-after-free in the browser's Import component, allowing a remote attacker who lures a victim into opening a malicious file and performing specific UI gestures to execute arbitrary code. Rated High by Chromium and CVSS 7.5, the flaw has no public exploit identified at time of analysis and a low EPSS of 0.24% (15th percentile), consistent with its high attack complexity and required user interaction. A vendor patch is available in the June 2026 Stable channel update.
Remote code execution in Google Chrome for macOS prior to 150.0.7871.47 stems from a use-after-free in the GFX (graphics) component, allowing a remote attacker to run arbitrary code after a victim opens a crafted HTML page. Chromium rates the severity High and the CVSS is 8.8, but exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and EPSS is low (0.26%, 17th percentile), indicating no observed weaponization yet.
Sandbox escape in Google Chrome's Chromecast component (versions before 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page. Rooted in a use-after-free (CWE-416) memory-corruption bug rated High by Chromium, it carries a CVSS 8.3 driven by a scope change and full CIA impact, but requires a pre-existing renderer compromise, high attack complexity, and user interaction. No public exploit identified at time of analysis, and the low EPSS (0.21%) plus SSVC 'exploitation: none' indicate it is not currently being exploited.
Remote code execution in Google Chrome (Views UI component) prior to 150.0.7871.47 allows a remote attacker to execute arbitrary code by luring a victim to a crafted HTML page and inducing specific UI gestures that trigger a use-after-free. Rated High by Chromium and CVSS 7.5, the flaw is elevated in complexity by its requirement for user interaction, and no public exploit has been identified at time of analysis; EPSS probability is low at 0.26%.
Heap corruption in Google Chrome's QUIC networking stack (versions prior to 150.0.7871.47) stems from a use-after-free that a remote attacker can trigger through crafted network traffic, potentially leading to arbitrary code execution in the affected browser process. Google rated the Chromium security severity as High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as 'none'. EPSS is low (0.19%, 9th percentile), indicating no observed weaponization despite a total technical-impact rating.
Sandbox escape in Google Chrome for macOS versions prior to 150.0.7871.47 stems from a use-after-free in the Touchbar component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Reported through Google's internal Chrome security process and rated High by Chromium, it carries a CVSS 9.6 due to scope change and full CIA impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.21%. SSVC assesses current exploitation as none, indicating this is a patch-now-but-not-panic item.