Description
Use after free in SSL in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free bug in the SSL implementation of Google Chrome on ChromeOS allows a remote attacker to retrieve sensitive information from process memory by loading a specially crafted HTML page. This flaw can expose private data without requiring any interaction beyond visiting the malicious page and is catalogued as a memory‑disclosure vulnerability.

Affected Systems

The vulnerability affects Google Chrome running on ChromeOS before version 150.0.7871.47. Any device using an older Chrome revision is susceptible until the security patch is installed.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation yet. The CVSS score of 6.5 classifies this vulnerability as medium severity, but it remains a potent mechanism for leaking confidential data if a user visits a malicious site. The exploit requires only a crafted HTML page and does not need privileged access, making it remotely exploitable from the browser context.

Generated by OpenCVE AI on July 1, 2026 at 13:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 150.0.7871.47 or later.
  • Ensure automatic updates are or manually install the latest Chrome update from the official Google Chrome release channel.
  • Keep monitoring Chrome release notes for additional security updates and apply them promptly.

Generated by OpenCVE AI on July 1, 2026 at 13:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Wed, 01 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in SSL Allows Memory Disclosure on ChromeOS

Wed, 01 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in SSL Allows Memory Disclosure on ChromeOS

Wed, 01 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Use after free in SSL in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T01:15:14.772Z

Reserved: 2026-06-29T23:11:42.790Z

Link: CVE-2026-14103

cve-icon Vulnrichment

Updated: 2026-07-01T01:00:28.768Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T13:45:02Z

Weaknesses