EUVD-2026-40664
GHSA-5vj5-q8pj-x572
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Network delivery requires no attacker credentials (PR:N), but AC:H reflects the mandatory renderer pre-compromise prerequisite; S:C encodes the sandbox escape; C/I/A:L matches confirmed limited direct impact per description.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient data validation in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome prior to 150.0.7871.47 exploits a heap-based buffer overflow (CWE-122) in the Storage component, enabling an attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is a chained, second-stage vulnerability - renderer compromise through a separate flaw is a hard prerequisite, making standalone exploitation infeasible. EPSS sits at 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; a vendor patch is confirmed available as Chrome 150.0.7871.47.
Technical ContextAI
The vulnerability resides in Chrome's Storage subsystem, which serves web storage APIs (localStorage, sessionStorage, IndexedDB, and related quota management) within Chrome's multi-process architecture. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: insufficient data validation allows attacker-controlled input to overflow a heap buffer in this subsystem, enabling adjacent memory corruption. Chrome's security model confines renderer processes inside an OS-level sandbox; a successful heap overflow exploitation here allows crossing that boundary. The CVSS S:C (Scope Changed) metric formally encodes this sandbox escape dynamic. Tags confirm the heap overflow classification (Buffer Overflow, Heap Overflow). The Chromium issue tracker entry at issues.chromium.org/issues/513858286 is the upstream defect record, though technical details may be restricted pending broader patch adoption. Affected versions are all Chrome releases prior to 150.0.7871.47 across desktop platforms, confirmed by EUVD-2026-40664.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, the confirmed vendor-released patch per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. End users should trigger the update via chrome://settings/help; enterprise administrators should deploy through Google's enterprise management tooling or group policy. Because this vulnerability requires prior renderer compromise, defenders unable to patch immediately can reduce their exposure surface by mitigating the renderer attack vector: ensure Chrome's Site Isolation (--site-per-process) is enforced via enterprise policy (enabled by default in modern Chrome), restrict browsing to trusted origins where feasible, and consider deploying Chrome's Enhanced Safe Browsing to block known malicious pages that may serve renderer exploits. Note that these controls address only the first link in the chain - the Storage heap overflow itself has no workaround short of patching.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today