EUVD-2026-50814
GHSA-jfrf-4g9q-hwqj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryCompromise renderer via separate bug
-
ExploitTrigger Input use-after-free in browser process
-
ExecutionReclaim freed object to corrupt memory
-
PersistEscape sandbox with browser-process privileges
-
ImpactExecute code outside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (an explicit prerequisite in the CVE description) and that the victim loads attacker-controlled content (UI:R - user interaction such as visiting a crafted HTML page). This is a sandbox-escape primitive, not a standalone RCE: the renderer-compromise requirement means it must be paired with a separate initial-access exploit, which materially limits standalone exploitation. Limiting factors are the need for a working renderer exploit, user interaction to load the page, and an unpatched Chrome build below 151.0.7922.72; no special non-default configuration is required beyond running a vulnerable version. |
| Impact | The signals are mixed and must be weighed together. CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) looks critical, but the description reveals a crucial precondition the base metrics understate: the attacker must ALREADY have compromised the renderer process, making this a second-stage sandbox-escape primitive rather than a standalone remote-code-execution bug - which meaningfully raises real-world attack complexity above the vector's AC:L. EPSS is low at 0.29% (21st percentile), the CVE is NOT on CISA KEV, and no public exploit is identified at time of analysis, consistent with a bug useful mainly inside a chained exploit by capable actors. No SSVC decision record is present in the input. Net assessment: a genuine priority to patch because Chrome is ubiquitous and browser-process escapes are high value in exploit chains, but low EPSS and the renderer-compromise prerequisite argue against imminent mass exploitation. Note the tags list 'Denial Of Service,' which understates impact - the vendor and description describe a sandbox escape, so treat this as memory corruption/escape, not merely DoS. |
| Exploit ScenarioDerived | An attacker first compromises a Chrome renderer via a separate bug (e.g., a malicious ad or iframe), then lures the victim to a crafted HTML page that triggers the use-after-free in the browser process's Input handling to escape the sandbox and gain browser-process privileges. Chained with the initial renderer bug, this yields full code execution outside the sandbox. No public exploit is identified at time of analysis, but browser-process UAFs are prime candidates for targeted exploit chains. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the browser's Input handling, which an attacker who has already compromised the renderer process can leverage via a crafted HTML page to break out of the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to scope change, it requires user interaction (visiting a malicious page) and a prior renderer foothold. There is no public exploit identified at time of analysis and EPSS is low (0.29%), reflecting a chained, non-trivial exploitation path rather than trivial mass exploitation.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the built-in updater (chrome://settings/help) and relaunch to apply, as described in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Enterprises should push the update through managed browser policies and verify the version fleet-wide, since Chrome's silent-update mechanism can be blocked by pinned versions or restricted network egress. If immediate patching is not possible, reduce the renderer-compromise prerequisite this bug depends on: enforce Site Isolation (default on), keep the sandbox enabled (never launch with --no-sandbox), and restrict browsing to trusted sites via URL allowlisting or remote browser isolation for high-risk users - the trade-off is reduced usability and residual exposure to any allowlisted-but-compromised site. There is no standalone toggle for the Input component, so upgrading is the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Input subsystem, the browser-process component that processes input events and related IPC from renderer processes. Use-after-free occurs when a pointer to freed memory is reused, allowing an attacker who controls allocation timing and heap layout to reclaim the freed object and manipulate its state, typically yielding controlled memory corruption and code execution. Because the vulnerable code runs in the higher-privileged browser process (S:C, scope change), successful exploitation crosses the renderer/browser trust boundary that Chrome's multi-process sandbox is designed to enforce. Per CPE cpe:2.3:a:google:chrome, all Chrome desktop builds prior to the fixed 151.0.7922.72 are affected across platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network vector with user interaction to load a page, but AC:H because a prior renderer compromise and heap grooming are required; scope changes (S:C) as the browser process is escaped with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
A critical vulnerability in Google Chrome (CVE-2026-17688, CVSS 9.6) could allow attackers who have already compromised the browser to escalate their access to the host operating system, potentially compromising confidential business data and system integrity. While no active exploitation has been identified, the severity and scope of potential impact require immediate deployment of Chrome 151.0.7922.72 organization-wide.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB