EUVD-2026-50786
GHSA-36fh-9j3c-fp3f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious HTML page
-
DeliveryCompromise renderer via separate bug
-
ExploitSend crafted input to Network service
-
ExecutionEscape sandbox via input-validation flaw
-
ImpactExecute code outside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (a prior renderer exploit is a hard prerequisite named directly in the description), plus user interaction (UI:R) in the form of the victim loading a crafted HTML page, and the affected Chrome version must be prior to 151.0.7922.72. Limiting factors: high attack complexity (AC:H) meaning the bug is not reliably or trivially triggered, dependence on chaining with a separate renderer compromise, and the need for the user to visit attacker-controlled content - so this is not standalone remote-unauthenticated code execution despite PR:N in the vector. |
| Impact | The signals are mixed and should be read together. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, score 8.3) reflects network reach, high impact, and a scope change, but also encodes real friction: high attack complexity and required user interaction. Critically, the description states the attacker must have ALREADY compromised the renderer process - a prerequisite the PR:N metric does not capture, so raw CVSS overstates standalone exploitability; this is a chaining bug, not a single-shot RCE. EPSS is low (0.29%, 21st percentile), it is NOT on CISA KEV, and no public exploit was identified, so there is no evidence of active or imminent mass exploitation. Realistic priority is moderate-to-high for a browser (it is a sandbox escape that meaningfully raises the value of any renderer bug), but it is not a drop-everything emergency absent an exploit chain. Note the Tags label this 'Information Disclosure' while CVSS asserts full C/I/A impact and the description frames it as sandbox escape - treat the tag as imprecise and rely on the vendor severity of High. |
| Exploit ScenarioDerived | An attacker first compromises the Chrome renderer with a separate memory-corruption or logic bug (for example by luring a user to a malicious site), then serves a crafted HTML page whose renderer-side code sends malformed input to the Network service to escape the sandbox and gain code execution outside the renderer's constraints. No public exploit is identified at time of analysis, and the high attack complexity plus required renderer foothold make this a targeted, chained operation rather than commodity attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's Network component before 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Rated High by Chromium and scored CVSS 8.3, it is a second-stage bug that must be chained with an initial renderer exploit rather than exploited in isolation. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on every desktop platform, then fully restart the browser so all renderer and network processes reload the patched code - Chrome auto-updates but the fix does not take effect until relaunch. Verify via chrome://settings/help and enforce the minimum version through enterprise policy or your patch-management tooling for managed fleets. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and issue tracker https://issues.chromium.org/issues/497428001. There is no configuration toggle that specifically neutralizes this Network-component bug; as compensating controls until patched, restrict browsing of untrusted sites, deploy site isolation and OS-level sandboxing (already default), and use application allowlisting/EDR to catch post-escape activity - these reduce but do not eliminate exposure, at the cost of some usability and coverage gaps.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Chrome's Network service, a component of the Chromium multi-process architecture that brokers network requests on behalf of the sandboxed renderer. The root cause is classified as CWE-20 (Improper Input Validation): the Network component insufficiently validates untrusted input coming from a renderer that an attacker already controls, letting that input cross the renderer/broker trust boundary. Because Chrome deliberately treats the renderer as untrusted, any logic that accepts renderer-supplied data without strict validation can become a sandbox-escape primitive, which is why the CVSS scope is marked Changed (S:C). The affected product per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Attacker must first control the renderer, so PR:H; AC:H and UI:R reflect chaining plus a crafted page; scope changes on sandbox escape with full host impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 151.0.7922.72 contain a privilege escalation vulnerability that allows an attacker who has compromised the browser process to access the underlying operating system and other applications on the host. This transforms a browser-confined infection into a full system compromise, significantly increasing the impact of web-based attacks for any organization where Chrome users encounter untrusted content.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB