EUVD-2026-50813
GHSA-8m3j-qh2v-pc64
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Scored as a web-facing sandbox-escape chain component: network vector, user must load a page (UI:R), scope changes from renderer to host (S:C) with full C/I/A impact; PR:N retained per vendor scoring despite the renderer-compromise prerequisite.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
AnalysisAI
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and CVSS 9.6, the flaw is a CWE-843 type confusion; Google has shipped a fixed Stable channel build. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (per the description) and then delivers a crafted HTML page that drives ANGLE into a type-confused state to escape the sandbox; user interaction is required in that the victim must load attacker-controlled web content (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects NVD/vendor scoring of the web-content attack surface with a scope change (renderer sandbox to host), but this must be read against the description, which explicitly states the attacker must have ALREADY compromised the renderer process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first compromises Chrome's renderer through a separate bug when the victim visits a malicious or compromised web page, then serves crafted HTML/WebGL content that triggers the ANGLE type confusion to corrupt memory in the GPU/host process and escape the sandbox, gaining code execution at higher privilege. No public exploit is identified for this specific issue, and the attack requires the victim to load the page (UI:R) plus a pre-existing renderer compromise. |
| Remediation | Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel and restart the browser to apply it (see https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Chrome deployments in your environment and communicate the mandatory patch requirement to users and IT teams. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Memory Corruption
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today