Description
Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-06-30
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use-after-free condition in the HTML5 Canvas implementation of Google Chrome versions earlier than 150.0.7871.47 allows a remote attacker to execute arbitrary code within the browser's sandbox. The vulnerability is a classic memory‑corruption flaw (CWE-416) that can be triggered by a crafted HTML page code occurs only inside the sandbox.

Affected Systems

All users running Google Chrome prior to version 150.0.7871.47 are affected. The June 2026 update fixed the issue, so the vulnerability is not present in that release. No other vendors or product lines were affected.

Risk and Exploitability

The CVE has a CVSS score of 8.8, indicating a high severity flaw. The EPSS score is less than 1%, suggesting a low probability of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is an attacker hosting a malicious web page that the victim opens or visits; a single click on the page would trigger risk remains moderate to high until a user upgrades to the June 2026 release (version 150.0.7871.47 or later).

Generated by OpenCVE AI on July 15, 2026 at 11:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 150.0.7871.47 or later to obtain the patch that fixes the use‑after‑free bug.
  • Restart the browser after upgrading to ensure no residual vulnerable processes remain running.
  • If an upgrade is unattainable, consider applying a policy to disable the Canvas feature until the update can be applied, thereby eliminating the exploitation surface for the affected code path.

Generated by OpenCVE AI on July 15, 2026 at 11:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Wed, 15 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Canvas Enables Remote Code Execution

Mon, 13 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Canvas Enables Remote Code Execution in Google Chrome

Sun, 12 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Canvas Enables Remote Code Execution in Google Chrome

Sat, 11 Jul 2026 03:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Canvas Allows Remote Sandbox Code Execution

Thu, 09 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Canvas Allows Remote Sandbox Code Execution

Thu, 09 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Canvas Enables Arbitrary Code Execution

Tue, 07 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Canvas Enables Arbitrary Code Execution

Mon, 06 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Canvas Enables Remote Code Execution inside Browser Sandbox

Mon, 06 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Canvas Enables Remote Code Execution inside Browser Sandbox

Sun, 05 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Canvas Enables Remote Code Execution within Chrome Sandbox

Sat, 04 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Canvas Enables Remote Code Execution within Chrome Sandbox

Sat, 04 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Canvas Enables Remote Code Execution in Google Chrome

Sat, 04 Jul 2026 00:30:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Canvas Enables Remote Code Execution in Google Chrome

Fri, 03 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Canvas Permits Remote Code Execution inside Chrome Sandbox

Thu, 02 Jul 2026 07:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Canvas Permits Remote Code Execution inside Chrome Sandbox

Thu, 02 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Canvas Allows Remote Code Execution Inside Sandbox

Wed, 01 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Canvas Allows Remote Code Execution Inside Sandbox

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Title Use After Free in Chrome Canvas Enables Remote Code Execution

Wed, 01 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Title Use After Free in Chrome Canvas Enables Remote Code Execution

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-02T03:55:43.830Z

Reserved: 2026-06-29T23:03:25.956Z

Link: CVE-2026-13821

cve-icon Vulnrichment

Updated: 2026-07-01T13:33:42.391Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-15T11:15:16Z

Weaknesses