EUVD-2026-39040
GHSA-jw4x-8999-54r8
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Crafted HTML is network-delivered (AV:N) needing victim load (UI:R); the race plus required prior renderer compromise justify AC:H; sandbox escape changes scope (S:C) with full host impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome's DevTools component (versions prior to 149.0.7827.197) lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page that triggers a race condition. Rated High by Chromium with a scope-changing CVSS 8.3, it requires a prior renderer compromise plus user interaction, and there is no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is the explicit precondition in the CVE and the single most important limiting factor, making this a second-stage sandbox-escape link rather than a standalone remote bug. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and point to a real-but-conditional priority rather than an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first achieves code execution inside Chrome's sandboxed renderer (for example by chaining a separate renderer RCE bug), then serves a specially crafted HTML page that the victim opens. The page drives DevTools so as to win a race-condition window, allowing the attacker to escape the renderer sandbox into the privileged browser process and gain broader access on the host. … |
| Remediation | Vendor-released patch: update Google Chrome to 149.0.7827.197 or later via the Stable channel, then fully relaunch the browser so the new binary loads (Chrome auto-updates but the restart is required to apply it); see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Chrome versions prior to 149.0.7827.197 and prepare update strategy. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today