CVE-2026-7974
HighSummary
Use after free in Blink in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Risk Assessment
This vulnerability could lead to remote code execution, posing a significant security risk to systems using the affected version of the browser.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability.
Other vulnerabilities in Google Chrome (Blink)
See all- CVE-2017-5087High
A use after free in Blink in Google Chrome prior to version 59.0.3071.104 for Mac, Windows, and Linux, and prior to version 59.0.3071.117 for Android, allows a remote attacker to perform an out of bounds memory read via a crafted HTML page, known as an IndexedDB sandbox escape.
- CVE-2017-5064High
Incorrect handling of DOM changes in Blink in Google Chrome prior to version 58.0.3029.81 for Windows allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2017-5056High
A use after free vulnerability in Blink in Google Chrome prior to version 57.0.2987.133 for Linux, Windows, and Mac, and prior to version 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- CVE-2017-5052High
A flaw in block structure in Blink in Google Chrome prior to version 57.0.2987.133 for Mac, Windows, and Linux, and prior to version 57.0.2987.132 for Android, allows a remote attacker to potentially exploit memory corruption via a crafted HTML page that triggers improper casting.
- CVE-2016-5145High
Blink in Google Chrome before version 52.0.2743.116 does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image. This allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
- CVE-2016-1710High
The ChromeClientImpl::createWindow method in Blink, used in Google Chrome before version 52.0.2743.82, does not prevent window creation by a deferred frame, allowing remote attackers to bypass the Same Origin Policy via a crafted website.
- CVE-2016-1660High
Blink, as used in Google Chrome before version 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes. This allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web site.
- CVE-2016-1634High
A use-after-free vulnerability in the StyleResolver::appendCSSStyleSheet function in Blink, used in Google Chrome before version 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted website.
- CVE-2015-1228High
The RenderCounter::updateCounter function in Blink, used in Google Chrome before version 41.0.2272.76, does not force a relayout operation, leading to uninitialized memory for a data structure. This allows remote attackers to cause application crashes or potentially other unspecified impacts via a crafted CSS token sequence.
- CVE-2015-1227High
The DragImage::create function in Blink, used in Google Chrome before version 41.0.2272.76, does not initialize memory for image drawing. This may allow remote attackers to trigger an unspecified impact by causing a failed image decoding.
Original NVD description (English source)
Use after free in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)