EUVD-2026-40555
GHSA-95mc-3qfr-rvgq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H because exploitation requires a pre-compromised renderer and controlled heap grooming; UI:R for the crafted page; S:C and full C/I/A:H reflect the sandbox escape into the privileged browser process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome's Device component on Windows (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416). Google rates the Chromium security severity as Medium, reflecting that it is a second-stage bug requiring prior renderer compromise, though the NVD CVSS of 9.6 is inflated by the sandbox scope change. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have ALREADY compromised the renderer process (explicitly stated in the description) and to then deliver a crafted HTML page that drives the vulnerable Device code path - this is a sandbox-escape/second-stage bug, not a standalone remote entry point. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and must be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first lands a separate renderer-process compromise (e.g., a prior Chrome RCE) when the victim visits or is redirected to a malicious page, then serves crafted HTML/JavaScript that triggers the use-after-free in the Device component to break out of the sandbox and run code in the privileged browser process. No public exploit is identified at time of analysis, and success depends on the victim first executing attacker-controlled content in a vulnerable renderer. |
| Remediation | Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on Windows via the Chrome stable channel, then fully restart the browser so the new binary loads (Chrome auto-updates but requires a relaunch to apply). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Notify Windows system owners and confirm Google's patch availability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today