EUVD-2026-40725
GHSA-hwh2-jx98-3hx9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Requires a pre-compromised renderer (PR:H) and successful exploit chaining (AC:H); sandbox escape crosses into the browser process (S:C) yielding high confidentiality/integrity impact but no availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Sandbox escape in Google Chrome's New Tab Page prior to 150.0.7871.47 allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. The flaw stems from insufficient validation of untrusted input (CWE-20) and requires a pre-existing renderer foothold, making it a second-stage exploit rather than an initial-access vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process - this is an explicit prerequisite from the description, not optional. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply and must be reconciled. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first lands a separate renderer-process compromise (e.g., via a Chrome RCE) when a victim visits a malicious site, then uses that foothold to feed crafted HTML/input to the New Tab Page and escape the sandbox into the browser process. No public exploit code has been identified, and the attack is only viable as the second stage of an exploit chain that already achieved renderer code execution. |
| Remediation | Upgrade to the primary fix, Vendor-released patch: Google Chrome 150.0.7871.47 or later, via the stable desktop channel; Chrome's auto-update will deliver this, but administrators should force-relaunch to apply it since a running browser is not protected until restarted, and Chromium-based downstream browsers (Edge, Brave, etc.) should be updated once their vendors ship the merged fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Chrome deployments across the organization and identify systems with administrative access or internet-facing exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today