Description
Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-06-30
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw (CWE‑416) in the Forms component of Google Chrome allows a remote attacker to trigger crafted HTML content that results in arbitrary code execution within the browser’s sandbox. The vulnerability can be exercised by opening a malicious HTML page and the impact is elevated execution of code inside the browser process.

Affected Systems

Google Chrome versions earlier than 150.0.7871.47 are affected, and the defect was fixed in Chrome 150.0 releases.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of < 1% indicates that exploitation is considered rare, but the flaw still permits a remote attacker to trigger arbitrary code execution by opening a crafted HTML page. The vulnerability is not listed in CISA KEV.

Generated by OpenCVE AI on July 17, 2026 at 14:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest update to Google Chrome (150.0.7871.47 or newer), which contains the fixed Forms component.
  • If immediate update is not possible, block or quarantine the vulnerable Chrome executable using local security controls such as AppLocker, Gatekeeper, or firewall rules to prevent outbound traffic from the browser when it processes malicious form data.
  • Monitor the browser for anomalous process creation or memory corruption logs; consider enabling Chrome’s built‑in safety features (e.g., Safe Browsing) to detect and block malicious sites delivering crafted HTML.

Generated by OpenCVE AI on July 17, 2026 at 14:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Thu, 16 Jul 2026 00:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Use-After-Free in Chrome Forms

Tue, 14 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Use-After-Free in Chrome Forms

Sun, 12 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Forms Enables Remote Code Execution via Crafted HTML

Sat, 11 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Forms Enables Remote Code Execution via Crafted HTML

Thu, 09 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Forms Enables Remote Code Execution

Wed, 08 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Forms Enables Remote Code Execution

Mon, 06 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Forms Enables Remote Code Execution

Mon, 06 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Forms Enables Remote Code Execution

Sun, 05 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Forms Enables Remote Code Execution via Crafted HTML

Sun, 05 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Forms Enables Remote Code Execution via Crafted HTML

Sat, 04 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Use-after-free in Chrome Forms Enables Remote Code Execution

Sat, 04 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Title Use-after-free in Chrome Forms Enables Remote Code Execution

Fri, 03 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Forms Allows Remote Code Execution

Fri, 03 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Forms Allows Remote Code Execution

Thu, 02 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Chrome Use‑After‑Free in Forms Allows Remote Code Execution

Thu, 02 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Chrome Use‑After‑Free in Forms Allows Remote Code Execution

Thu, 02 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Forms Component Allows Remote Code Execution in Chrome

Wed, 01 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Forms Component Allows Remote Code Execution in Chrome

Wed, 01 Jul 2026 18:15:00 +0000

Type Values Removed Values Added
Title Chrome Forms Use-After‑Free Enables Sandbox Code Execution

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Title Chrome Forms Use-After‑Free Enables Sandbox Code Execution

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-02T03:55:34.036Z

Reserved: 2026-06-29T23:03:32.744Z

Link: CVE-2026-13848

cve-icon Vulnrichment

Updated: 2026-07-01T13:23:47.573Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-17T15:00:10Z

Weaknesses