EUVD-2026-39040
GHSA-jw4x-8999-54r8
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Crafted HTML is network-delivered (AV:N) needing victim load (UI:R); the race plus required prior renderer compromise justify AC:H; sandbox escape changes scope (S:C) with full host impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome's DevTools component (versions prior to 149.0.7827.197) lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page that triggers a race condition. Rated High by Chromium with a scope-changing CVSS 8.3, it requires a prior renderer compromise plus user interaction, and there is no public exploit identified at time of analysis. SSVC lists exploitation as none, indicating no observed in-the-wild use despite the total technical impact.
Technical ContextAI
The flaw lives in Chrome's DevTools, the built-in debugging and inspection subsystem that is privileged relative to web content because it can drive the browser through the Chrome DevTools Protocol. CWE-20 (Improper Input Validation) is the assigned root-cause class, but the description specifically attributes the bug to a race condition - a time-of-check/time-of-use style concurrency window in which two operations interleave in an unintended order to corrupt state and cross the renderer-to-browser trust boundary. Chrome's multi-process model isolates web content inside a sandboxed renderer; a successful exploit escalates from that already-compromised renderer into the more privileged browser process, which is why CVSS marks Scope=Changed. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome desktop application across versions below the fix.
RemediationAI
Vendor-released patch: update Google Chrome to 149.0.7827.197 or later via the Stable channel, then fully relaunch the browser so the new binary loads (Chrome auto-updates but the restart is required to apply it); see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html. In managed fleets, push the update through your enterprise update policy and confirm the effective version. Until updated, compensating controls reduce exposure: because exploitation depends on a prior renderer compromise, prioritize blocking that first stage - keep Chrome current, keep Site Isolation enabled (default), and restrict high-risk browsing. You can also reduce DevTools-specific exposure with the DeveloperToolsAvailability enterprise policy (trade-off: this breaks legitimate web-development and some extension/debugging workflows) and limit users' ability to open untrusted local HTML. These are partial mitigations only; upgrading is the definitive fix.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today