EUVD-2026-50701
GHSA-775j-7vvx-3xm5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage content processed by AdFilter
-
ExploitTrigger improper privilege handling (CWE-269)
-
ExecutionExecute arbitrary code in renderer sandbox
-
Impact(requires chained escape for host impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML content processed by Chrome's AdFilter component (UI:R - the user must visit or be redirected to a crafted page), and no authentication is required (PR:N). The primary limiting factor is that successful exploitation yields code execution only inside the renderer sandbox, not on the host, so full system compromise additionally requires chaining a distinct sandbox-escape bug. Affected only if running Chrome desktop prior to 151.0.7922.72; user interaction (navigating to the malicious page) is mandatory, and Chrome's site isolation/sandbox must be circumvented for any impact beyond the renderer. |
| Impact | Signals are mixed and should be weighed together rather than by CVSS alone. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) is high, driven by network vector, low complexity, no privileges, and high C/I/A impact, but it requires user interaction (UI:R) and the scope is Unchanged (S:U), consistent with the description's key caveat that code runs 'inside a sandbox.' Chromium itself rated this only Medium, which contrasts with the 8.8 base score - the CVSS impact metrics do not reflect the sandbox containment that limits real-world blast radius. EPSS is low (0.26%, 17th percentile), it is not on CISA KEV, and no public exploit is identified, so this is a real-but-not-urgent priority: important to patch as part of normal Chrome update cadence, but not an actively-exploited emergency. Note the tension: NVD/tags label this 'RCE / Privilege Escalation,' yet the described impact is sandbox-contained code execution, which typically requires chaining with a separate sandbox-escape bug to threaten the host - verify blast radius before treating as full RCE. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page - or injects malicious ad/filter content into a page the victim already trusts - and lures the target into visiting it. When the page is rendered, the AdFilter component mishandles the content and the attacker gains arbitrary code execution within the renderer sandbox; to affect the host, the attacker would then need to chain a separate sandbox-escape vulnerability. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandboxed arbitrary code execution in Google Chrome's AdFilter component (versions prior to 151.0.7922.72 on desktop) allows a remote attacker to run code inside the renderer sandbox by luring a victim to a crafted HTML page. Rated Medium by Chromium and CVSS 8.8 by NVD, the flaw requires user interaction (visiting a malicious site) but no authentication; execution is confined to the sandbox rather than achieving full host compromise. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the desktop Stable channel, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); relaunch the browser to complete the update since Chrome staging does not apply until restart. In managed fleets, push the update via enterprise policy or your patch-management tooling and force a browser relaunch to ensure the patched binary is loaded. No standalone workaround is provided by the vendor for the AdFilter defect itself; as interim compensating controls until the update is deployed, restrict browsing to trusted sites and use web/DNS filtering to block untrusted or newly-registered domains (trade-off: does not stop malicious content on otherwise-trusted or compromised sites), and ensure OS-level and site-isolation sandbox protections remain enabled since the flaw is sandbox-contained and site isolation raises the bar for a full escape. Verify Chromium-based derivatives against their own vendor advisories and update them accordingly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Chrome's AdFilter subsystem, part of the browser's content/ad-blocking and filtering logic that parses and acts on attacker-influenced HTML/DOM content within the renderer process. It is classified as CWE-269 (Improper Privilege Management), meaning the component mishandles a privilege or trust boundary such that attacker-controlled page content can drive code execution within the renderer's security context. The affected component runs inside Chrome's multi-process sandbox, so the described 'arbitrary code execution inside a sandbox' means the attacker gains code execution in the constrained renderer rather than in the higher-privileged browser or OS context - a meaningful limitation that aligns with Chromium's 'Medium' internal severity despite the high NVD CVSS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no auth but requires the user to visit it (UI:R); high renderer-context C/I/A with scope unchanged since impact is sandbox-contained.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 on desktop contain an unauthenticated vulnerability enabling arbitrary code execution within the browser's sandbox when users visit malicious websites. With no public exploit identified at time of analysis, the immediate threat is contained, but this affects all organizational Chrome users and could enable credential theft or data exfiltration if exploitation tools emerge.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Multiple Security Flaws
View all 80Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB