EUVD-2026-50727
GHSA-7v9m-6384-f4jq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Chrome Extension
-
DeliveryDeliver via store or sideload
-
ExploitVictim installs and loads extension
-
ExecutionTrigger use-after-free in Extensions
-
PersistHijack dangling pointer control flow
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a specially crafted Chrome Extension into a vulnerable Chrome build (< 151.0.7922.72) - the crafted extension is the exact trigger named in the description, and CVSS UI:R confirms user interaction (installing/enabling the extension) is mandatory. Limiting factors: the attacker cannot force installation silently, so social engineering or a compromised extension supply-chain is needed; resulting code execution is explicitly confined 'inside a sandbox' (CVSS S:U, no scope change), meaning it does not by itself yield host or browser-process compromise without a chained sandbox escape. Environments that block or allowlist extensions via enterprise policy are not exploitable through the normal user-install path. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) reflects network reach, low complexity, no privileges, but required user interaction and unchanged scope. Critically, this raw score overstates real-world risk: Chromium's own severity is Medium and the description confines execution to the sandbox (S:U, no escape), so an attacker does not gain host code execution from this bug alone - it would need to be chained with a sandbox-escape primitive. Corroborating signals point to low near-term risk: EPSS is 0.24% (15th percentile), there is no CISA KEV listing, and no public exploit is identified. The UI:R requirement (victim must load a crafted extension) further limits mass exploitation. Note the tension worth flagging: the vector's C:H/I:H/A:H and PR:N read as a severe unauthenticated network bug, but the 'inside a sandbox' language and Medium Chromium rating indicate the practical impact is bounded - treat as a routine patch-cycle priority, not an emergency, absent evidence of a chained escape. |
| Exploit ScenarioDerived | An attacker publishes or sideloads a malicious Chrome Extension crafted to trigger the use-after-free in the Extensions component; when a victim installs and loads it (satisfying the UI:R requirement), the dangling pointer is groomed to hijack control flow and run attacker code within the sandboxed extension/renderer process. No public exploit is identified at time of analysis, and the achieved execution is confined to the sandbox unless paired with a separate escape primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox-confined remote code execution in Google Chrome's Extensions component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code inside the browser sandbox by getting a victim to load a crafted Chrome Extension, exploiting a use-after-free (CWE-416). Chromium rated the severity Medium because execution is contained within the sandbox rather than achieving full host compromise, though the NVD-style CVSS is 8.8. There is no public exploit identified at time of analysis, and EPSS is low at 0.24% (15th percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable Channel Update for Desktop (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome auto-updates, so ensure clients relaunch the browser to apply the fix and verify the running version under chrome://settings/help. As a compensating control until patched, restrict extension installation through enterprise policy (ExtensionInstallBlocklist set to '*' with an ExtensionInstallAllowlist of vetted IDs, or ExtensionInstallForcelist for managed-only extensions) so users cannot load untrusted or crafted extensions - the trade-off is reduced user flexibility and possible breakage of legitimately-used add-ons. Users of Chromium-based browsers (Edge, Brave, Opera) should apply their vendor's build incorporating Chromium 151.0.7922.72. No sandbox-escape chain is required by this specific CVE, so keeping site isolation and the extension sandbox enabled (defaults) preserves the containment that limits impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's Extensions subsystem - the browser component that loads, manages, and executes WebExtension code (manifest-based extensions with their background service workers, content scripts, and extension APIs). A use-after-free occurs when memory is freed but a dangling pointer is later dereferenced, allowing an attacker who controls heap layout to reclaim the freed allocation and hijack control flow. Per the affected CPE (cpe:2.3:a:google:chrome:*), this affects the desktop Chrome browser (Chromium engine) on all platforms served by the stable channel update; because the description specifies code executes 'inside a sandbox,' the corruption is triggered within the renderer/extension process boundary rather than the privileged browser process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted extension triggers the bug with low complexity and no prior privileges but requires the user to load it (UI:R); impact is high yet scope-unchanged since code stays sandboxed (S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a use-after-free vulnerability in the Extensions component that allows remote code execution within the browser sandbox when users load a malicious extension. While confined to the browser process, exploited instances can access and exfiltrate sensitive data, login credentials, and browsing history, creating material risk to employee productivity and data security across the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Multiple Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB