EUVD-2026-50799
GHSA-vfc9-3hpj-ph62
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Requires a prior renderer compromise (modeled as PR:L) and chaining plus user interaction raise complexity to AC:H; sandbox escape justifies S:C with high C/I/A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process (a prior, separate exploit is a hard prerequisite), plus user interaction to load a crafted HTML page that drives malicious QUIC traffic (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The raw CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is driven heavily by the scope change (S:C) reflecting the sandbox-escape impact, but the vector's PR:N is somewhat misleading in isolation: the description explicitly states the attacker must have ALREADY compromised the renderer process, which is a substantial real-world prerequisite not captured by PR:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first exploits a separate renderer-level vulnerability to run code inside Chrome's sandboxed renderer (for example, by luring a user to a malicious website), then delivers a crafted HTML/QUIC payload that triggers the integer overflow in the QUIC stack to corrupt memory in a more privileged process and escape the sandbox onto the host. No public proof-of-concept is identified at time of analysis, and the low attack complexity (AC:L) means that once a renderer foothold and the crafted page are in place, the escape itself is straightforward. |
| Remediation | Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel, as announced in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to ensure the update is applied since Chrome staged updates only take effect after a relaunch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Deploy notifications to all users explaining the critical patch requirement and block unpatched Chrome versions from accessing enterprise systems if technically feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today