EUVD-2026-50782
GHSA-6wpc-625g-qwg8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage triggers Ozone use-after-free
-
ExploitReclaim freed object in reallocated memory
-
ExecutionCorrupt browser-process state
-
PersistEscape renderer sandbox
-
ImpactExecute code outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome desktop build prior to 151.0.7922.72 (UI:R user interaction - the user must visit or open the malicious page). No authentication or prior privileges are needed (PR:N), and the attack is network-delivered against default configurations, but it is NOT a zero-click bug: without the victim rendering the crafted page it cannot fire. The bug targets the Ozone component, so exposure is tied to desktop Chrome using the Ozone platform stack; the practical limiter is the user-interaction requirement plus the low automatability (SSVC Automatable=no), meaning reliable exploitation likely needs a tailored memory-grooming payload rather than a commodity drive-by. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects a network-reachable, low-complexity, unauthenticated bug that requires user interaction (visiting a page) and crosses a security scope boundary (sandbox escape) - consistent with the Critical rating and 'total' technical impact in SSVC. However, the exploitation signals moderate that severity: SSVC lists Exploitation=none and Automatable=no, EPSS is only 0.31% (23rd percentile), there is no KEV listing, and no public POC is referenced. This is a genuinely high-priority patch for browser fleets because of the impact class and universal deployment, but it is not currently evidence of mass or automated exploitation. Note a mild tension: the input Tags include 'Denial Of Service' while the description and CVSS describe a sandbox escape with full C/I/A impact - the sandbox-escape framing should be treated as authoritative and the DoS tag as secondary/imprecise. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures a victim to open it in a vulnerable Chrome build; when rendered, the page triggers the Ozone use-after-free to corrupt browser-process memory and escape the renderer sandbox. With AC:L and UI:R, a single click on a link or a malvertising redirect is sufficient, and success grants the attacker code execution outside the sandbox. No public POC or exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Ozone platform abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader host access. Rated Critical by Chromium with CVSS 9.6 and a scope-changed vector, though exploitation currently shows as none in CISA SSVC and EPSS is low (0.31%). Vendor patch is available; no public exploit or KEV listing has been identified at time of analysis.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 - upgrade to this build or later on all desktop endpoints per the Stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates, so verify via chrome://settings/help and relaunch to apply the update, and push the update through enterprise management (Google Update / policy) to ensure fleet coverage. There is no product-specific configuration workaround for a memory-corruption sandbox escape; as an interim compensating control before patch rollout completes, limit exposure by restricting browsing to trusted sites and enabling stricter site isolation, though this does not neutralize the underlying bug and only reduces the chance of encountering a malicious page. Users of Chromium-based browsers should apply their vendor's corresponding update once published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ozone is Chromium's platform abstraction layer that mediates low-level windowing, graphics/GPU surface, and input handling across backends (X11, Wayland, DRM). The flaw is CWE-416 (Use After Free): a memory object in Ozone is freed while a dangling reference remains reachable, and subsequent access to that stale pointer allows an attacker to influence freed-then-reallocated memory. Because Ozone sits at the boundary between the sandboxed renderer and higher-privileged browser/GPU processes, corrupting its state is a classic primitive for a sandbox escape rather than a mere renderer crash. The affected surface per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build), i.e. the desktop Chrome browser across platforms using the Ozone stack.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered via a crafted page with no auth (PR:N) but requiring the victim to open it (UI:R); sandbox escape crosses a trust boundary (S:C) with full impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Ozone in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome versions before 151.0.7922.72 contain a critical sandbox escape vulnerability that could allow attackers to gain system-level access on affected employee workstations. Any user visiting a malicious website could trigger this vulnerability, compromising their endpoint and potentially providing attackers access to sensitive corporate data and internal networks. While no active exploitation has been observed, the technical severity and ubiquity of Chrome across your workforce make this a priority remediation target.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB