EUVD-2026-50806
GHSA-cwp6-3cc4-8qxc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
DeliveryCompromise sandboxed renderer process
-
ExploitDeliver malformed Color data
-
ExecutionTrigger heap buffer overflow
-
PersistEscape sandbox to host OS
-
ImpactExecute with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process on ChromeOS - this is the explicit precondition stated in the description ('a remote attacker who had compromised the renderer process') and is the primary limiting factor. It further requires user interaction (UI:R): the victim must load a crafted HTML page, and the target must be Chrome on ChromeOS running a version prior to 151.0.7922.72. The bug is not exploitable from a default, un-compromised browser state on its own; it is a sandbox-escape primitive that must be chained to an initial renderer code-execution flaw, which is why despite AV:N/PR:N the realistic attack surface is narrower than a standalone remote unauthenticated RCE. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H yields 9.6 (Critical), driven by the scope change (S:C) that reflects crossing the sandbox boundary into the OS, with full C/I/A impact. However, the description reveals a critical mitigating precondition the raw vector understates: the attacker must ALREADY have compromised the renderer process, meaning this is a second-stage bug, not a standalone remote-unauthenticated RCE. This is why signals conflict: CVSS is 9.6 but EPSS is only 0.31% (24th percentile) and it is NOT in CISA KEV, indicating no observed widespread exploitation. The PR:N in the vector reflects Chromium's convention of treating a compromised renderer as the attacker's baseline capability, so 'unauthenticated' here does not mean trivially reachable from the open internet. Net: this is a genuinely serious bug worth prompt patching (sandbox escapes are prized in exploit chains), but the practical barrier of needing a working renderer exploit first makes it a chain component rather than an immediately wormable single-shot flaw. No POC is present in the provided data. |
| Exploit ScenarioDerived | An attacker first lands a working renderer exploit (e.g., a separate memory-safety bug) when a ChromeOS user visits a malicious website, gaining code execution inside the sandboxed renderer. From that foothold, the attacker delivers crafted HTML/color data that triggers the heap buffer overflow in the Color component to corrupt memory and escape the sandbox, gaining higher-privileged execution on the device. No public exploit is identified in the provided data, and UI:R means the victim must visit the attacker's page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome on ChromeOS (versions prior to 151.0.7922.72) stems from a heap buffer overflow in the Color component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the severity High and the CVSS score is 9.6 owing to the scope change into the host OS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.31% (24th percentile), consistent with a second-stage bug that requires a prior renderer compromise.
RemediationAI
Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome/ChromeOS to 151.0.7922.72 or later, as published in the Chrome Stable Channel update advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). On ChromeOS, ensure automatic OS updates are enabled and force a device restart to apply the pending update, and use enterprise policies (Google Admin console) to pin managed fleets to the fixed milestone. If immediate patching is not possible, reduce exposure to the initial renderer-compromise stage by restricting browsing to trusted sites and enforcing a strict site-isolation/enterprise browsing policy; note this only lowers the odds of the precursor renderer exploit and does not remove the Color overflow itself, so it is a stopgap, not a fix. There is no feature toggle that disables the vulnerable Color path without breaking rendering, so upgrading is the only reliable remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-122 heap-based buffer overflow located in Chromium's 'Color' handling code, which processes color values and profiles derived from web content (e.g., CSS colors, ICC/color-management data). Malformed input can cause an out-of-bounds write on the heap, corrupting adjacent allocator metadata or object pointers. Because the affected code runs in a privileged context reachable from the compromised renderer, a successful overflow can be leveraged to escape the renderer sandbox. The CPE cpe:2.3:a:google:chrome identifies the affected application as Google Chrome, and the description scopes real-world impact to the ChromeOS platform build. This is characteristic of a chained exploit: the memory-safety defect in Color is the sandbox-escape primitive, not the initial code-execution vector.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Retained AV:N/PR:N/UI:R per Chromium convention treating renderer compromise as baseline; S:C reflects sandbox escape into the OS with full C/I/A impact, matching 9.6.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Chrome on ChromeOS versions prior to 151.0.7922.72 contain a heap buffer overflow that enables sandbox escape; organizations running ChromeOS devices face potential operating system compromise if attackers first gain control of the browser's renderer process. Patching is critical for environments where ChromeOS hosts sensitive workloads or contain elevation of privilege paths.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB