EUVD-2026-35259
GHSA-m2rp-hqmh-cm5f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome on Linux prior to 149.0.7827.103 can be triggered by an integer overflow in the browser's UI component when a victim visits a crafted HTML page. Rated CVSS 9.6 with scope change, this issue allows a remote attacker to break out of the Chrome renderer sandbox after one click or navigation, though no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Victim must be running Google Chrome on Linux at a version below 149.0.7827.103 and must load attacker-controlled HTML content (UI:R in the CVSS vector - a click, navigation, opened tab, or iframe render is sufficient; no credentials or prior authentication are needed, PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H produces a 9.6 score driven primarily by the scope change (S:C) - the integer overflow in a UI-tier component crosses the sandbox boundary, which is exactly the property that elevates this above a typical renderer bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious HTML page (or compromises an ad network / third-party script on a legitimate site) containing the crafted input that triggers the integer overflow in Chrome's Linux UI code. A Linux user running an unpatched Chrome navigates to the page - the required user interaction is simply loading the URL - and the overflow corrupts state in the browser process, breaking out of the renderer sandbox and allowing the attacker to execute code with browser-process privileges, from which credential theft, persistence, or pivoting to local privilege escalation chains becomes feasible. … |
| Remediation | Upgrade to Google Chrome 149.0.7827.103 or later on Linux as the primary fix, per the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html; this is a vendor-released patch with an exact fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Notify stakeholders and begin testing Google Chrome 149.0.7827.103 on representative Linux systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today