EUVD-2026-40782
GHSA-f382-6c4g-qxjw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H because exploitation depends on a pre-existing renderer compromise; UI:R for victim page load; S:C and C/I/A:H reflect a full sandbox escape to the host.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Sandbox escape in Google Chrome desktop versions prior to 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and gain code execution on the host via a crafted HTML page. The flaw stems from insufficient policy enforcement in the browser process (CWE-20) and, while carrying a high CVSS base score of 9.6 due to the scope change, was rated only Low severity by Chromium because it is not independently exploitable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has ALREADY compromised the renderer process - this is the explicit, hard prerequisite stated in the CVE description, meaning the bug is a chain component that needs a prior renderer-level code-execution flaw before it can be used. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply and must be weighed together rather than taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first lands a separate renderer-level exploit (for example, a memory-corruption bug) when a victim visits a malicious or compromised website, gaining control of the sandboxed renderer process. From within that compromised renderer, the attacker serves crafted HTML/content that abuses the browser process's insufficient policy enforcement to escape the sandbox and execute code with the browser process's higher privileges on the host. … |
| Remediation | Vendor-released patch: 150.0.7871.47 - upgrade Google Chrome to 150.0.7871.47 or later on Windows, macOS, and Linux, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Chrome desktop installations across the organization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today