Cyber Posture

CVE-2026-2321

High

Published: 11 February 2026

Published
11 February 2026
Modified
25 February 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0015 34.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2321 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 34.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires timely identification, reporting, and correction of the use-after-free flaw in Chrome's Ozone component to eliminate the heap corruption vulnerability.

prevent

Implements memory protection safeguards such as ASLR and DEP to directly prevent exploitation of the use-after-free leading to heap corruption in Ozone.

prevent

Enforces process isolation through Chrome's sandboxing to contain the impact of Ozone use-after-free vulnerabilities and prevent system-wide compromise.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Use-after-free vulnerability in Chrome's Ozone component exploited via crafted HTML page requiring user UI gestures, directly mapping to Exploitation for Client Execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Use after free in Ozone in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Deeper analysisAI

CVE-2026-2321 is a use-after-free vulnerability (CWE-416) in the Ozone component of Google Chrome prior to version 145.0.7632.45. Published on 2026-02-11, it enables potential heap corruption when a user processes a crafted HTML page, with Chromium assigning it a Medium security severity.

A remote attacker with no privileges can exploit this vulnerability over the network with low complexity by convincing a targeted user to engage in specific UI gestures on a malicious webpage. Successful exploitation could result in high confidentiality, integrity, and availability impacts, as indicated by its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

The Chrome stable channel release notes and associated Chromium issue detail the patch in version 145.0.7632.45, recommending immediate updates to affected systems for mitigation.

Details

CWE(s)

Affected Products

google
chrome
≤ 145.0.7632.45

CVEs Like This One

CVE-2026-3921Same product: Apple Macos
CVE-2025-13638Same product: Apple Macos
CVE-2026-7348Same product: Apple Macos
CVE-2025-8578Same product: Apple Macos
CVE-2026-7338Same product: Apple Macos
CVE-2026-7940Same product: Apple Macos
CVE-2026-3919Same product: Apple Macos
CVE-2025-14765Same product: Apple Macos
CVE-2025-11460Same product: Apple Macos
CVE-2026-3923Same product: Apple Macos

References