EUVD-2026-50758
GHSA-v5ww-65h9-965q
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
AC:H reflects mandatory renderer pre-compromise; S:C captures sandbox escape; C/I/A:L because this step alone yields limited direct data impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) enables an attacker who has already achieved renderer-process compromise to break out of Chrome's sandbox via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Extensions subsystem, with a CVSS Scope:Changed rating confirming the impact extends beyond the browser process to the host OS. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with absence from CISA KEV - but the sandbox escape class carries disproportionate risk relative to its 5.8 base score because it enables full host-level code execution when chained with a renderer RCE.
Technical ContextAI
Google Chrome's multi-process architecture relies on a sandbox to isolate the renderer from the host OS. The Extensions subsystem serves as a privileged bridge between renderer-side content scripts and higher-privilege browser APIs. The affected component (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) fails to adequately validate untrusted input originating from a compromised renderer (CWE-20: Improper Input Validation). When an attacker controls renderer execution and passes maliciously crafted data through the Extensions interface, the validation gap allows renderer-level code to cross the sandbox boundary. This class of flaw - renderer-to-browser privilege escalation via a privileged IPC or API surface - is a well-documented Chrome security concern, distinct from a simple renderer RCE; it completes a two-stage exploit chain by providing the sandbox escape primitive.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later immediately; this is the vendor-released patch as documented in the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise environments using Google Chrome Browser Cloud Management or Active Directory group policy should force-push the update and verify version compliance via fleet management tooling. If immediate patching is blocked, disabling browser extensions via enterprise policy (ExtensionInstallBlocklist set to block all, or setting ExtensionSettings to force-disable) eliminates the vulnerable Extensions code path but will break extension-dependent workflows. Enforcing Chrome's Site Isolation policy (SitePerProcess) via enterprise settings increases the cost of the required renderer compromise prerequisite, reducing - but not eliminating - chain feasibility. Note that compensating controls address the prerequisite stage, not the vulnerability itself; patching remains the only complete fix.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today