Description
Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-06-04
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw in the Ozone rendering backend of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code by presenting a crafted HTML page. The vulnerability is identified as CWE‑416 (Use After Free) and CWE‑825, and is assigned a CVSS score of 8.8, indicating high severity. Chromium identifies the issue as critical, implying that exploitation could compromise the user’s system.

Affected Systems

Google Chrome browsers running a version earlier than 149.0.7827.53 are susceptible. This includes all stable channel releases on desktop platforms until that point in the 149.x series.

Risk and Exploitability

The flaw has a CVSS score of 8.8, indicating high severity. The EPSS score is less than 1%, indicating a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVE does not provide specific details regarding the existence of public exploits or authentication requirements; analysis of risk should therefore consider the high severity rating and the potential for remote code execution via a crafted HTML page.

Generated by OpenCVE AI on June 7, 2026 at 14:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to 149.0.7827.53 or a later version to eliminate the use‑after‑free bug.
  • Enable automatic browser updates so the fix is applied as soon as it becomes available.
  • Avoid opening or browsing HTML content from untrusted or unknown sources until the browser has been updated.

Generated by OpenCVE AI on June 7, 2026 at 14:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Ozone Allows Remote Code Execution via Crafted HTML chromium-browser: Use after free in Ozone
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 05 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Fri, 05 Jun 2026 06:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Ozone Allows Remote Code Execution via Crafted HTML

Fri, 05 Jun 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T00:33:26.265Z

Reserved: 2026-06-04T17:05:59.884Z

Link: CVE-2026-10902

cve-icon Vulnrichment

Updated: 2026-06-05T00:26:36.942Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-04T23:16:51.930

Modified: 2026-06-05T20:15:47.043

Link: CVE-2026-10902

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-10902 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T14:15:07Z

Weaknesses