Description
Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-07-30
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An internal use after free bug in Chrome's Enterprise code path can corrupt heap objects when a specially crafted HTML document is processed. The flaw may allow a remote attacker to execute arbitrary code on a user’s machine, potentially compromising confidentiality, integrity, or availability.

Affected Systems

All installations of Google Chrome built before 151.0.7922.72 are affected, regardless of operating system. The issue exists in the Enterprise channel and may impact Windows, macOS, and Linux releases that have not yet received the fix.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.8, indicating high severity. An EPSS score of less than 1% suggests that exploitation attempts are currently rare, and the flaw is not listed in CISA's KEV catalog. The likely attack vector, inferred from the description, involves a victim loading a malicious HTML page, so delivery via phishing or compromised websites is most plausible.

Generated by OpenCVE AI on August 2, 2026 at 06:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 151.0.7922.72 or later.
  • Implement web‑content filtering or restrict browsers from accessing untrusted pages to mitigate the risk of a crafted HTML attack.
  • Disallow the Enterprise channel on older systems until the patch is applied.

Generated by OpenCVE AI on August 2, 2026 at 06:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Fri, 31 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Use after free in Enterprise
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 30 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-31T03:56:10.912Z

Reserved: 2026-07-27T23:35:12.207Z

Link: CVE-2026-17886

cve-icon Vulnrichment

Updated: 2026-07-30T16:06:39.303Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:52.540

Modified: 2026-08-03T17:36:24.240

Link: CVE-2026-17886

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-30T00:19:48Z

Links: CVE-2026-17886 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T06:30:17Z

Weaknesses