EUVD-2026-40639
GHSA-54gw-x8gh-f524
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered via crafted page (AV:N, UI:R); AC:H and dependence on a pre-compromised renderer, but no auth needed (PR:N); sandbox escape crosses trust boundary (S:C) with total impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the renderer sandbox by abusing insufficient policy enforcement in the browser's USB (WebUSB) handling, delivered through a crafted HTML page. The flaw is rated Medium by Chromium but carries a high CVSS (8.3) due to the scope change from renderer to browser process; EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already control a Chrome renderer process (the description explicitly states 'a remote attacker who had compromised the renderer process'), meaning this is a second-stage sandbox-escape and cannot be triggered from an unmodified renderer alone. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are consistent and point to real-but-conditional risk rather than mass-exploitation urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first gains code execution inside a Chrome renderer - for example via a separate renderer RCE bug triggered when the victim opens a malicious page - then chains this flaw by having that page's crafted content abuse the USB policy gap to escape the sandbox into the higher-privileged browser process. Given AC:H and UI:R, success requires the victim to visit attacker content and a reliable renderer-compromise primitive; no public exploit is identified at time of analysis. |
| Remediation | Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the June 2026 Stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); restart the browser to complete the update since Chrome staged updates only apply on relaunch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: notify users and IT of the available patch. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today