EUVD-2026-40489
GHSA-jmxm-fm2m-r778
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Delivered via crafted web page (AV:N, UI:R); the renderer-compromise prerequisite and unreliable type-confusion trigger justify AC:H; sandbox escape crosses a trust boundary (S:C) with total impact (C/I/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process escalate out of the sandbox via a crafted HTML page that triggers a type-confusion bug (CWE-843) in the Tabs component. Exploitation is gated behind prior renderer compromise and user interaction, and the flaw is rated High by Chromium with a CVSS 8.3 due to scope change and total impact. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and CISA SSVC lists exploitation as none.
Technical ContextAI
The vulnerability is a type confusion (CWE-843) in Chrome's Tabs implementation, part of the Chromium browser process that manages tab lifecycle and cross-process coordination. Type confusion occurs when code operates on an object while assuming it is a different type than it actually is, allowing an attacker to reinterpret memory (e.g., treating a data field as a pointer), which commonly yields memory corruption and control-flow hijacking. Because Chrome uses a multi-process sandbox model where untrusted web content runs in a low-privilege renderer, a bug in a higher-privilege browser-side component like Tabs is a classic sandbox-escape primitive: the compromised renderer sends crafted IPC/state that confuses the more-privileged process. The vendor tags (Memory Corruption, Information Disclosure) are consistent with a type-confusion primitive. Affected builds are all desktop Chrome stable channel prior to 150.0.7871.47.
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms; this is the primary and complete fix, delivered via the stable-channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Force the update by navigating to chrome://settings/help to trigger the auto-update check and then relaunching the browser, and in managed fleets push the patched build through enterprise update policies or your endpoint management tooling. Because exploitation requires a prior renderer compromise, interim compensating controls that reduce renderer-level attack surface help: enable and enforce Chrome's Site Isolation (default) and 'Enhanced Protection' Safe Browsing, and consider enabling the renderer app-container/strict-sandbox and 'Isolate origins' enterprise policies - trade-off is modestly higher memory usage. Restricting or warning on untrusted sites via URL filtering reduces the odds of the initial renderer bug being reached, at the cost of user friction. There is no need for a downgrade or feature disablement given a patched build is available; upgrading is strongly preferred over mitigations.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today