Description
Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-09-29
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw was discovered in ServiceWorker handling in Google Chrome version 154.0.8037.57 and earlier. The flaw allows an attacker to craft a malicious HTML page that, when opened by an affected user, causes the browser to execute arbitrary code outside the sandbox. The vulnerability is classified as Critical by Chromium and is identified as a memory‑management weakness (CWE‑416).

Affected Systems

The affected product is Google Chrome on all supported operating systems (Windows, macOS, and Linux). Versions before 154.0.8037.57 are vulnerable; later releases contain the patch that prevents the use‑after‑free condition.

Risk and Exploitability

The CVSS score of 9.6 indicates extremely high impact if exploited. The EPSS score is not available, so the current probability of exploitation cannot be quantified from public data. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote attacker sending a specially crafted HTML page that the victim opens, which triggers the malformed ServiceWorker code and results in code execution beyond the browser sandbox.

Generated by OpenCVE AI on September 29, 2026 at 23:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 154.0.8037.57 or later, which fixes the use‑after‑free in ServiceWorker.
  • If an immediate upgrade is not feasible, disable ServiceWorker functionality or block service‑worker registration via group policy or browser flags until the patch can be applied.
  • Configure the browser to automatically receive updates and monitor Google security advisories for future patches and additional mitigations.

Generated by OpenCVE AI on September 29, 2026 at 23:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Use-After-Free in Chrome ServiceWorker chromium-browser: Use after free in ServiceWorker
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 30 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Use-After-Free in Chrome ServiceWorker

Tue, 29 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-30T03:55:54.461Z

Reserved: 2026-09-22T05:09:42.845Z

Link: CVE-2026-95339

cve-icon Vulnrichment

Updated: 2026-09-29T18:00:12.534Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:26.480

Modified: 2026-09-30T16:27:32.400

Link: CVE-2026-95339

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-29T17:31:35Z

Links: CVE-2026-95339 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T00:00:13Z

Weaknesses