EUVD-2026-50825
GHSA-49qh-vm7v-wv5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious file to local user
-
DeliveryUser opens file in Chrome
-
ExploitTrigger use-after-free in Views
-
ExecutionReclaim freed object in browser process
-
PersistEscape renderer sandbox
-
ImpactExecute code at browser privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local delivery of a malicious file and user interaction to open/process it in Google Chrome (AV:L, UI:R in the CVSS vector), so it is not remotely exploitable without user action. The attacker needs no prior authentication or privileges (PR:N) once the victim opens the file. Limiting factors: the victim must be running a vulnerable Chrome build (< 151.0.7922.72) and must actively open the attacker's file, and the technique yields a sandbox escape rather than initial remote access - meaning it is most valuable when chained with a renderer-side bug. SSVC marks the flaw as not automatable, reflecting these hands-on-victim prerequisites. |
| Impact | Signals here are mixed and lean toward lower real-world urgency despite the 8.6 CVSS. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - local attack vector requiring user interaction (opening a malicious file) but with a scope change and total confidentiality/integrity/availability impact, which is why the score is high. EPSS is very low at 0.18% (7th percentile), CISA SSVC marks Exploitation as none and Automatable as no (consistent with the required user interaction and local vector), though Technical Impact is total. There is no KEV listing and no public exploit identified at time of analysis. Note a tension worth flagging: the vendor severity is 'High' and CVSS is 8.6, yet the vector is local (AV:L) with required UI - this is a sandbox-escape primitive, not a remote, wormable bug, so priority should be normal patch-cycle rather than emergency, absent evidence of exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious file and social-engineers a local user into opening it in Chrome; processing the file triggers the use-after-free in Views, corrupting browser-process memory to escape the renderer sandbox and gain code execution at the browser process's privilege level. No public exploit is identified at time of analysis, and the local vector plus required user interaction make this a targeted rather than mass-exploitation scenario. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a local attacker who lures a user into opening a malicious file break out of the renderer sandbox with high-severity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records exploitation as none, and the EPSS score is very low (0.18%, 7th percentile). Google has released a fixed stable-channel build.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so ensure the browser is fully closed and relaunched to apply the update, and verify the version via chrome://settings/help. The authoritative advisory is Google's stable-channel update post (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Because exploitation requires the user to open a malicious file, interim compensating controls until patching completes include instructing users not to open untrusted files delivered via Chrome and enforcing enterprise auto-update policies to shorten the exposure window; these have minimal functional trade-offs. Downstream Chromium-based browsers should be updated to a build incorporating the equivalent Views fix once their vendors publish it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chromium's Views, the C++ UI toolkit that renders Chrome's native windows, menus, and browser chrome. Use-after-free bugs occur when a pointer to a freed heap object is subsequently dereferenced, allowing an attacker to reclaim that memory with controlled data and hijack object behavior (e.g., corrupting vtable pointers). Because Views runs in the higher-privileged browser process rather than the sandboxed renderer, corrupting its state is a path to escaping Chrome's sandbox. The affected component is identified only as cpe:2.3:a:google:chrome:*, i.e., Google Chrome across versions prior to the fix.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Local malicious-file vector with required user interaction (AV:L/UI:R), no prior privileges (PR:N), and a sandbox escape crossing a trust boundary yields scope change with high C/I/A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop versions prior to 151.0.7922.72 contain a vulnerability in the rendering engine that permits local attackers to bypass Chrome's sandbox isolation. This protection boundary-which prevents malicious web content and third-party code from accessing user data or system resources-can be circumvented, exposing users to potential data theft and system compromise.
Apply vendor patch: Google Chrome 151.0.7922.72 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB