EUVD-2026-34420
GHSA-fpw8-fw44-c744
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the Printing component. Chromium rates the issue High severity and a vendor patch is available, though no public exploit has been identified at time of analysis and EPSS remains very low at 0.05%.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Windows systems running Google Chrome versions prior to 149.0.7827.53 and flag for expedited patching. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all Windows endpoints through your standard browser update mechanism. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing t
Privilege elevation in Microsoft Azure HorizonDB allows remote unauthenticated attackers to bypass authentication via id
Local privilege escalation in Google Android XR stems from a missing permission check in InputMethodManagerService.addIn
Arbitrary file read and remote code execution in Vitest versions prior to 4.1.0 allow remote unauthenticated attackers t
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows a remote attacker to trigge
Share
External POC / Exploit Code
Leaving vuln.today