Description
Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Published: 2026-05-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw was discovered in the Aura UI framework of Google Chrome, affecting releases prior to 148.0.7778.216. This vulnerability is a CWE‑416 and CWE‑825 condition that can lead to remote code execution when a crafted HTML page forces a user to perform specific UI gestures. The flaw enables an attacker to execute arbitrary code within the browser context, which in turn could allow further compromise of the host system.

Affected Systems

Google Chrome is affected when the browser version is below 148.0.7778.216. No other vendors or product variants are listed as impacted.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.5, indicating high severity per the Chromium security team. The EPSS score is currently unavailable, and the issue is not cataloged in the CISA KEV list. Exploitation requires the attacker to lure a user to engage with a specially crafted web page, implying a social‑engineering component. The lack of a publicly available proof‑of‑concept suggests that while the risk is high, the likelihood of widespread exploitation remains uncertain, though it could be used in targeted attacks.

Generated by OpenCVE AI on May 29, 2026 at 13:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 148.0.7778.216 or later to remove the use‑after‑free flaw.
  • Ensure that all installations maintain automatic updates so that new releases are deployed within a short timeframe.
  • As a temporary measure, reduce or eliminate risky UI gestures on untrusted sites by configuring site‑specific sandboxing or browser extension policies, and educate users to avoid interacting with suspicious web pages.

Generated by OpenCVE AI on May 29, 2026 at 13:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 29 May 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Fri, 29 May 2026 12:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free Vulnerability in Chrome Enables Remote Code Execution chromium-browser: Use after free in Aura
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Fri, 29 May 2026 00:30:00 +0000

Type Values Removed Values Added
Title Use-After-Free Vulnerability in Chrome Enables Remote Code Execution
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 28 May 2026 22:45:00 +0000

Type Values Removed Values Added
Description Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-30T03:55:39.330Z

Reserved: 2026-05-28T17:24:54.559Z

Link: CVE-2026-9934

cve-icon Vulnrichment

Updated: 2026-05-29T10:34:07.318Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-28T23:16:51.513

Modified: 2026-05-29T12:16:28.703

Link: CVE-2026-9934

cve-icon Redhat

Severity : Important

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-9934 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-29T14:00:20Z

Weaknesses