EUVD-2026-50799
GHSA-vfc9-3hpj-ph62
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to malicious page
-
DeliveryCompromise renderer via separate bug
-
ExploitDeliver crafted QUIC/HTML payload
-
ExecutionTrigger integer overflow in QUIC
-
PersistCorrupt memory across sandbox boundary
-
ImpactEscape sandbox to host privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process (a prior, separate exploit is a hard prerequisite), plus user interaction to load a crafted HTML page that drives malicious QUIC traffic (UI:R). The vulnerable code path is Chrome's QUIC/HTTP-3 implementation, so environments that have disabled QUIC would not expose the affected transport. This is not a standalone unauthenticated RCE despite PR:N in the CVSS vector; the renderer-compromise dependency and required user interaction meaningfully limit real-world exploitation to a chained-attack context against un-updated Chrome versions below 151.0.7922.72. |
| Impact | The raw CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is driven heavily by the scope change (S:C) reflecting the sandbox-escape impact, but the vector's PR:N is somewhat misleading in isolation: the description explicitly states the attacker must have ALREADY compromised the renderer process, which is a substantial real-world prerequisite not captured by PR:N. This is best understood as one link in an exploit chain, not a standalone remote-code-execution bug. Supporting signals are relatively low-risk: EPSS is only 0.29% (21st percentile), the CVE is NOT in CISA KEV, and no public exploit code is identified at time of analysis. Chromium rates it High (not Critical) internally. Net assessment: a genuinely serious bug worth prompt patching because Chrome is ubiquitous and chained renderer-to-sandbox-escape exploits are the standard modern browser attack pattern, but it is not evidence of active mass exploitation and should be prioritized as routine-urgent browser patching rather than emergency incident response. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer-level vulnerability to run code inside Chrome's sandboxed renderer (for example, by luring a user to a malicious website), then delivers a crafted HTML/QUIC payload that triggers the integer overflow in the QUIC stack to corrupt memory in a more privileged process and escape the sandbox onto the host. No public proof-of-concept is identified at time of analysis, and the low attack complexity (AC:L) means that once a renderer foothold and the crafted page are in place, the escape itself is straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel, as announced in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to ensure the update is applied since Chrome staged updates only take effect after a relaunch. In managed environments, push the update via enterprise policy or your endpoint management tooling and verify the reported version on endpoints. As an interim compensating control before patching, you can disable QUIC/HTTP/3 via the enterprise policy or the chrome://flags 'Experimental QUIC protocol' setting to remove the vulnerable transport path - the trade-off is that connections fall back to TCP/HTTP2, which may slightly increase latency but generally maintains functionality. Because exploitation requires a prior renderer compromise, keeping the browser fully updated (site isolation and renderer sandbox intact) is the most effective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
QUIC is Google's UDP-based transport protocol (the basis of HTTP/3) implemented natively in Chrome's network service. The root cause is CWE-190 (Integer Overflow or Wraparound), where arithmetic on attacker-influenced values wraps past the maximum representable integer, typically leading to undersized buffer allocations and subsequent out-of-bounds memory access - consistent with the 'Buffer Overflow' tag applied to this issue. Because QUIC parsing and the memory-corruption primitive are reachable in a way that lets a compromised renderer influence a more privileged process, this becomes a sandbox-escape vector rather than a simple renderer crash. The affected component is the desktop Chrome browser (CPE cpe:2.3:a:google:chrome), fixed in the Stable channel build 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Requires a prior renderer compromise (modeled as PR:L) and chaining plus user interaction raise complexity to AC:H; sandbox escape justifies S:C with high C/I/A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome sandbox escape vulnerability (CVE-2026-17673, CVSS 9.6) enables post-compromise attackers to escape the browser sandbox and access the host system, a critical capability that could lead to lateral movement and data exfiltration across enterprise networks. Affecting all Chrome users under version 151.0.7922.72, this vulnerability requires immediate patching to maintain endpoint isolation controls.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB