EUVD-2026-50795
GHSA-c8v5-9fjp-jxcc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to malicious page
-
DeliveryDeliver crafted HTML in Chrome iOS
-
ExploitTrigger protection-mechanism failure
-
ExecutionEscape browser sandbox
-
ImpactAccess privileged context / device data
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted HTML page in Chrome for iOS on a version prior to 151.0.7922.72 (per CVSS UI:R, user interaction is mandatory - the attacker cannot trigger it without the user loading the content). No authentication or prior privileges are needed (PR:N), and the attack is remote over the network (AV:N) with low complexity (AC:L). Limiting factors: the mandatory user interaction prevents drive-by automation at scale (SSVC Automatable: no), the vulnerable software is specifically the iOS Chrome build below the fixed version, and no default-configuration precondition beyond running the affected app is indicated. There is no public exploit and SSVC exploitation status is 'none', so realistic risk hinges on successful social-engineering delivery. |
| Impact | The signals are mixed. CVSS 3.1 rates this 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) driven by network reach, low complexity, no privileges, and total confidentiality/integrity/availability impact after a scope change - consistent with SSVC's 'Technical Impact: total'. However, real-world exploitation pressure appears low: EPSS is only 0.29% (21st percentile), SSVC records Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit is identified. The requirement for user interaction (UI:R - the victim must load attacker-controlled HTML) meaningfully limits mass automation, aligning with SSVC's not-automatable finding. Net: a genuinely high-severity browser bug worth prompt patching, but current evidence points to potential rather than active or scalable exploitation. Note a minor tension worth flagging - the input Tags list 'Information Disclosure' whereas the description and CVSS (I:H/A:H, sandbox escape) indicate impact well beyond disclosure; treat the tag as incomplete metadata, not a scoping limit. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures an iOS user into opening it in Chrome (for example via a phishing link, malicious ad, or compromised site). When the page loads, the inappropriate implementation of the browser's protection mechanism is triggered, letting the attacker escape the sandbox and gain access beyond the isolated web context. No public proof-of-concept has been identified, and the requirement for the victim to open the page (UI:R) means the attack is not automatable at scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome for iOS before version 151.0.7922.72 allows a remote attacker to break out of the browser's security boundary when a victim opens a crafted HTML page. Rated High by Chromium and carrying a 9.6 CVSS due to a scope-changing, high-impact outcome requiring only user interaction, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). A vendor-released patch is available and CISA SSVC currently records exploitation status as none.
RemediationAI
Vendor-released patch: update Chrome for iOS to 151.0.7922.72 or later, which is the primary and recommended fix; on iOS this is delivered through the Apple App Store, so ensure automatic app updates are enabled or push the update via MDM for managed fleets. Refer to Google's advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue at https://issues.chromium.org/issues/513142464. Until devices are updated, reduce exposure by advising users not to open untrusted links or attacker-supplied HTML pages and by restricting browsing to trusted sites, since exploitation depends on loading a crafted page (UI:R); organizations can layer web/URL filtering or a secure web gateway to block known-malicious pages, accepting the trade-off that such controls cannot catch all novel malicious HTML and may impact browsing convenience.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified under CWE-693 (Protection Mechanism Failure), describing a case where an existing security control - here the browser sandbox that isolates untrusted web content from the host device and other origins - is implemented inappropriately and can be bypassed rather than a memory-corruption primitive per se. The affected component is the Chrome for iOS application (CPE cpe:2.3:a:google:chrome), which on iOS is constrained by Apple's mandatory WebKit engine, so the 'sandbox escape' concerns Chrome's own process/isolation model layered atop iOS. A crafted HTML page triggers the weak protection boundary, and the CVSS scope-change flag (S:C) reflects that the impact crosses from the sandboxed renderer context into a more privileged security domain.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs no privileges but requires the victim to open it (UI:R); sandbox escape crosses trust boundaries (S:C) with total impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome for iOS versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability enabling remote code execution when users visit malicious websites. This affects all iOS users within your organization, putting corporate devices and data at direct risk of compromise. A vendor patch is immediately available and should be deployed to all devices without delay.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB