EUVD-2026-50804
GHSA-h6gj-q2pj-9v5j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Requires prior renderer compromise (PR:L) and complex chaining (AC:H); successful sandbox escape crosses a trust boundary (S:C) with high C/I/A impact on the host.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in Chrome's ANGLE graphics abstraction layer (versions prior to 151.0.7922.72) can be leveraged by an attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a second-stage bug rather than a standalone drive-by. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is an explicit, concrete precondition stated in the CVE, not a default drive-by scenario; the OOB read in ANGLE is then reached via a crafted HTML page that the compromised renderer processes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects the classic Chrome scoring model where a malicious web page reached via user navigation is treated as network, low-complexity, no-privileges with user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first exploits a separate renderer vulnerability to gain code execution inside a sandboxed Chrome renderer, then serves or navigates that renderer to a crafted HTML page issuing malformed WebGL/graphics calls that trigger the ANGLE out-of-bounds read. The leaked GPU-process memory is used to defeat ASLR and, combined with further primitives, to break out of the sandbox onto the host. … |
| Remediation | Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable desktop channel, per the Chrome release advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); most installs auto-update, so verify via chrome://settings/help and relaunch to apply. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, notify administrators and security teams of Chrome's sandbox escape vulnerability; immediately scan enterprise endpoints to identify installations of Chrome versions prior to 151.0.7922.72 and assess exposure across user populations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today