EUVD-2026-50725
GHSA-jqr6-rm3g-4q3j
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
AV:N and PR:N reflect remote unauthenticated trigger; AC:H captures mandatory prior renderer compromise; S:C confirms sandbox escape; C/I/A:L reflect partial initial impact at OS process level.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Policy bypass in Chrome's Receiver component enables sandbox escape for attackers who have already compromised the renderer process, affecting all Google Chrome versions prior to 151.0.7922.72 on desktop platforms. Exploitation requires chaining a separate renderer compromise vulnerability with this Receiver policy bypass, triggered via a crafted HTML page with user interaction, allowing the attacker to escape Chrome's sandbox boundary and execute code at the OS process level. No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) and SSVC exploitation status of 'none' indicate low current exploitation probability.
Technical ContextAI
Chrome's multi-process architecture isolates untrusted web content in renderer processes, sandboxed from the OS by strict inter-process communication (IPC) policies enforced by the browser process. The Receiver component handles IPC message routing and policy enforcement between renderer and browser processes. CWE-693 (Protection Mechanism Failure) identifies the root cause as an incomplete or bypassable enforcement of the security policies governing what a compromised renderer is permitted to request or access. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop variants prior to 151.0.7922.72 across Windows, macOS, and Linux. The scope change (S:C) in the CVSS vector is consistent with a sandbox escape - the impact crosses from the sandboxed renderer into the OS-level browser process context. The Chromium issue tracker reference (issues.chromium.org/issues/513404032) is likely access-restricted per Google's standard vulnerability disclosure practice.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later immediately, as documented in the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will apply this update automatically in most consumer and managed environments; enterprise administrators should verify deployment via Chrome Browser Cloud Management or policy-based update enforcement and confirm the installed version is at or above 151.0.7922.72. No vendor-documented workaround exists for this specific Receiver policy bypass. As a compensating control for environments where immediate update is not possible, enabling Chrome's Site Isolation policy (--site-per-process, enabled by default in modern Chrome) reduces the blast radius of renderer compromises and limits the attack surface that this sandbox escape depends upon, though it does not eliminate the vulnerability.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today