EUVD-2026-50831
GHSA-97fj-f2h9-w8wj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend victim crafted HTML link
-
DeliveryVictim opens page in Chrome
-
ExploitTrigger integer overflow in libxml parser
-
ExecutionCorrupt renderer memory
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted HTML page in an unpatched Chrome (before 151.0.7922.72) - this user interaction (UI:R in the CVSS vector) is the primary limiting factor, so there is no drive-by/zero-click path from the available data. No authentication, special privileges, or non-default configuration is needed (PR:N), and the vulnerable HTML-parsing path via bundled libxml is reached in default browsing, so any user who visits the page while browsing normally is exposed. The key constraint that limits real-world impact is scope-unchanged (S:U): code runs only inside the renderer sandbox, meaning full host compromise additionally requires a separate sandbox-escape not covered by this CVE. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a network-reachable, low-complexity, unauthenticated bug that requires user interaction (visiting a page) and does not change scope. Signals are internally consistent but point to moderate rather than emergency priority: EPSS is low at 0.35% (28th percentile), CISA SSVC reports Exploitation: none and Automatable: no, and no public POC is identified - yet SSVC Technical Impact is rated 'total', matching the high C/I/A. The scope-unchanged (S:U) rating is important context: code execution is confined to the renderer sandbox, so real-world impact depends on chaining a sandbox escape, which the CVSS score alone does not capture. Net assessment: a genuinely serious memory-corruption RCE worth prompt patching in fleet browser-update cycles, but not currently an actively-exploited fire-drill. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malformed markup engineered to trigger the libxml integer overflow, then drives victims to it via phishing, malvertising, or a watering-hole link. When the target opens the page in an unpatched Chrome, the overflow corrupts renderer memory and executes attacker code inside the sandbox, typically as a first stage to be chained with a sandbox-escape for full host control. No public exploit is identified at time of analysis, and the low-complexity/network vector means only a single click on a malicious link is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page that triggers an integer overflow in the bundled libxml component. Google rated the flaw High severity and a vendor patch is available; there is no public exploit identified at time of analysis, and the low EPSS score (0.35%) alongside CISA SSVC 'Exploitation: none' indicates no observed exploitation yet. Because the bug is contained to the sandboxed renderer, a successful attacker would still need a separate sandbox-escape to reach the host.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; on managed fleets, force the browser update and relaunch to ensure the running process picks up the new binary, since Chrome's background updater stages the fix but only applies it on restart. Verify current version at chrome://settings/help and consult the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Until updates propagate, compensating controls include restricting browsing to trusted sites via enterprise policy or web-proxy allowlisting to reduce exposure to attacker-controlled HTML (trade-off: breaks general web access), and keeping the renderer sandbox enabled - do not launch Chrome with --no-sandbox - since the flaw yields only in-sandbox execution and the sandbox is the primary barrier to host compromise. Also confirm Chromium-based browsers in the environment are updated to versions incorporating the same libxml fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libxml (libxml2) is the XML/HTML parsing library Chromium bundles and invokes when handling markup within the renderer process. CWE-190 (Integer Overflow or Wraparound) describes the root cause: an arithmetic operation on attacker-influenced sizes or offsets wraps past the integer's maximum value, producing an undersized allocation or miscalculated bounds that leads to out-of-bounds memory access and ultimately controllable memory corruption. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the Chrome application as the affected surface; the overflow is reached purely by parsing a crafted HTML page, so no plugin or non-default component is needed to enter the vulnerable code path.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges but requires the victim to open it (UI:R); memory-corruption RCE gives high C/I/A, but execution stays within the renderer sandbox so scope is unchanged.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a remote code execution flaw that could compromise user browsers and expose organizational data or credentials when users visit malicious websites. While no active exploitation has been reported, widespread Chrome deployment makes this a material risk requiring immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-190 – Integer Overflow or Wraparound
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB