EUVD-2026-50778
GHSA-wqjr-h479-pxvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via prior exploit
-
DeliveryServe crafted HTML page
-
ExploitTrigger use-after-free in Views
-
ExecutionCorrupt browser-process memory
-
ImpactEscape sandbox to browser privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the renderer process (the description states this explicitly) - this bug is the sandbox-escape stage and cannot be triggered from a clean, uncompromised browser by itself. The victim must also render an attacker-controlled crafted HTML page (UI:R - user interaction, i.e. loading the page). Limiting factors: the mandatory prior renderer compromise is a significant real-world gate that raises attacker cost and typically implies a second exploit; only Chrome versions before 151.0.7922.72 are affected, and default site isolation makes obtaining the renderer foothold harder. No authentication is required (PR:N). |
| Impact | Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6) reflects a scope-changing, high-impact bug, but the AV:N/PR:N metrics understate a key real-world prerequisite explicitly stated in the description - the attacker must have ALREADY compromised the renderer process. This is not a single-shot remote exploit; it is the escape stage of a multi-bug chain, which materially raises the practical bar. EPSS is low at 0.31% (23rd percentile), and there is no KEV listing and no public exploit identified at time of analysis, so widespread opportunistic exploitation is not indicated. However, sandbox-escape UAFs in Views are historically attractive to sophisticated actors and n-day chainers once details or the patch are reverse-engineered, so the low EPSS reflects current publicity, not long-term difficulty. Net: patch-priority high due to Critical severity and browser ubiquity, but immediate mass-exploitation risk is currently low. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker first lands a separate renderer-process exploit (for example via a malicious ad or compromised site) to gain code execution inside the sandboxed renderer, then serves a crafted HTML page that drives the browser process into the Views use-after-free, corrupting browser-process memory to escape the sandbox and run code at the browser's higher privilege level. Given AV:N/AC:L/UI:R, the victim only needs to visit or render the attacker-controlled page. No public exploit is identified at time of analysis, so this reflects a plausible chain rather than an observed one. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sandbox escape in Google Chrome's Views UI framework (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Google rates the Chromium severity Critical (CVSS 9.6), and while a patch is available on the Stable channel, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.31%. Exploitation depends on chaining a prior renderer compromise, so this is one link in a full exploit chain rather than a standalone remote-code-execution bug.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel, then fully relaunch the browser so the new binary loads (per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed environments, push the update via your existing browser-management policy and confirm rollout, since Chrome's auto-update can be delayed by pinned versions or offline endpoints. No standalone workaround neutralizes a browser-process UAF, but because exploitation requires a prior renderer compromise, keeping site isolation enabled (default), avoiding untrusted or unnecessary browser extensions, and ensuring the whole Chromium fleet - including embedded/Electron and other Chromium-based browsers - is patched reduces the chance an attacker obtains the renderer foothold this bug depends on; the trade-off of these controls is operational only (extension review overhead), not functional loss of the browser.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Views, Chromium's cross-platform UI toolkit used to build browser windows, menus, and controls in the privileged browser process. A use-after-free occurs when memory is freed but a dangling pointer to it is later dereferenced; an attacker who controls heap allocations can reclaim the freed region and steer execution or corrupt state. Because Views runs in the higher-privilege browser process (outside the renderer sandbox), a memory-corruption primitive here is a classic sandbox-escape vector. The single CPE (cpe:2.3:a:google:chrome:*) confirms the affected component is the Chrome desktop application itself; the crafted HTML page is the delivery mechanism that drives the renderer to trigger the browser-side free/use sequence.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AV:N with UI:R since a crafted page is loaded, but AC:H because escape requires a pre-existing renderer compromise; scope changes from renderer sandbox to browser process with high impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome contains a critical sandbox escape vulnerability (CVE-2026-17652, CVSS 9.6) affecting versions prior to 151.0.7922.72. Exploitation requires a prior renderer process compromise, limiting immediate risk, but successful exploitation could allow complete system access. Organizations must prioritize patching to eliminate this link in potential multi-stage attacks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB