Description
Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-06-04
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw in the Ozone rendering backend of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code by presenting a crafted HTML page. The vulnerability is identified as CWE‑416 (Use After Free) and is assigned a CVSS score of 8.8, indicating high severity. Chromium identifies the issue as critical, implying that exploitation could compromise the user’s system.

Affected Systems

Google Chrome browsers running a version earlier than 149.0.7827.53 are susceptible. This includes all stable channel releases on desktop platforms until that point in the 149.x series.

Risk and Exploitability

The flaw has a CVSS score of 8.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The CVE does not provide specific details regarding the existence of public exploits or authentication requirements; analysis of risk should therefore consider the high severity rating and the potential for remote code execution via a crafted HTML page.

Generated by OpenCVE AI on June 5, 2026 at 05:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to 149.0.7827.53 or a later version to eliminate the use‑after‑free bug.
  • Enable automatic browser updates so the fix is applied as soon as it becomes available.
  • Avoid opening or browsing HTML content from untrusted or unknown sources until the browser has been updated.

Generated by OpenCVE AI on June 5, 2026 at 05:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 05 Jun 2026 06:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Ozone Allows Remote Code Execution via Crafted HTML

Fri, 05 Jun 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T00:33:26.265Z

Reserved: 2026-06-04T17:05:59.884Z

Link: CVE-2026-10902

cve-icon Vulnrichment

Updated: 2026-06-05T00:26:36.942Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-06-04T23:16:51.930

Modified: 2026-06-05T15:02:34.977

Link: CVE-2026-10902

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-05T06:00:06Z

Weaknesses