EUVD-2026-34563
GHSA-qmv8-5r2w-3px8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker stages malicious file on web/email lure
-
DeliveryUser on unpatched Chrome <149.0.7827.53 opens file
-
ExploitIsolated Web Apps handler mis-processes input
-
ExecutionAttacker code executes in IWA sandbox
-
ImpactAbuse sandboxed capabilities or stage sandbox-escape chain
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Use of function with inconsistent implementations
|
| Exploitation Conditions | Requires the victim to be running Google Chrome desktop earlier than 149.0.7827.53 with the Isolated Web Apps feature reachable, and requires user interaction (CVSS UI:R) - specifically the user must open or be induced to load a malicious file processed through the IWA code path. No authentication on the target is required (PR:N) and attack complexity is low (AC:L), so attackers do not need privileged access to the victim system, but exploitation is limited by the sandbox boundary (CVSS Scope:Unchanged and the description's explicit 'inside a sandbox' wording) - escaping to the host requires chaining a separate sandbox-escape bug, which materially reduces standalone real-world impact. |
| Impact | Signals are mixed and need to be reconciled carefully. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 8.8 (High), reflecting network reach, no privileges, and high CIA impact on the sandboxed scope, but Scope:Unchanged combined with the description's explicit 'inside a sandbox' qualifier means real impact is bounded to the renderer/IWA sandbox unless chained with a sandbox escape - Google itself rated the Chromium severity Medium, which is more representative of operational risk. EPSS is very low at 0.03% (10th percentile), the vulnerability is not on CISA KEV, and no public PoC has been identified, so this is not an immediate-fire issue; however, Chrome browser bugs historically attract exploit chain research, and the UI:R requirement (a user opening a malicious file) is a routine social-engineering bar. Net: patch promptly through normal Chrome update cycles, but this is not a drop-everything priority compared with confirmed KEV browser bugs. |
| Exploit ScenarioDerived | An attacker hosts or emails a crafted file referenced from a malicious or compromised web page; a targeted user with an unpatched Chrome opens or is induced to render the file through the Isolated Web Apps code path, and attacker-controlled code executes inside the IWA sandbox process. Without an additional sandbox-escape vulnerability the attacker is limited to actions available within that sandbox (e.g., abuse of IWA-granted capabilities, in-browser data access), but the foothold is a typical first link in a multi-bug browser exploit chain; no public PoC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 06, 2026
Arbitrary code execution within the Chrome sandbox affects Google Chrome desktop builds prior to 149.0.7827.53 due to an inappropriate implementation in the Isolated Web Apps (IWA) component. A remote attacker who convinces a user to open a malicious file can execute code confined to the sandbox process, with no public exploit identified at time of analysis and an EPSS score of only 0.03% (10th percentile) indicating low predicted exploitation likelihood. Google has shipped a fix in the stable channel update for desktop.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the built-in updater or by redeploying managed installers, then restart the browser so the new binaries take effect, per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For fleets that cannot patch immediately, disable the Isolated Web Apps feature via enterprise policy (IsolatedWebAppInstallForceList left empty and the IsolatedWebAppsEnabled / chrome://flags/#enable-isolated-web-apps trial turned off) to remove the affected surface, accepting that any legitimately deployed IWA-packaged internal applications will stop working; additionally, instruct users not to open untrusted files via the browser and consider tightening email/web gateway file-type filtering to reduce the chance of the malicious-file delivery vector. Track downstream Chromium-based browsers (Edge, Brave, Opera) for their respective security updates incorporating the same fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Isolated Web Apps are a Chromium feature designed to package web applications with stronger isolation guarantees and elevated platform capabilities, relying on a bundled signed web bundle format and a dedicated process model distinct from regular web origins. The flaw lies in how Chrome's IWA implementation handles a malicious file, allowing the attacker's payload to run inside the renderer/IWA sandbox process - code execution is therefore constrained by Chrome's multi-process sandbox and would normally require a separate sandbox escape bug to achieve full host compromise. No CWE was assigned by NVD, but the wording 'inappropriate implementation' is Chrome's standard label for logic-flaw classes rather than memory corruption, and the affected component is identified via CPE cpe:2.3:a:google:chrome:*.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop versions before 149.0.7827.53 contain an arbitrary code execution vulnerability (CVE-2026-11102, CVSS 8.8) in the Isolated Web Apps component that executes when users open malicious files. Although no public exploit exists and real-world exploitation risk is currently low (0.03% EPSS), the vulnerability affects billions of managed Chrome instances across most organizations and requires immediate patching.
Apply vendor patch: Google Chrome 149.0.7827.53 or later (stable channel). Interim: Enforce mandatory auto-updates through browser policy; block execution of suspicious file types at email gateway; monitor for anomalous sandbox behavior in endpoint detection tools.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Vendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB