EUVD-2026-50583
GHSA-85jh-mvhg-cjgw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryCompromise renderer via separate bug
-
ExploitSend malformed input over IPC to Passwords
-
ExecutionTrigger input-validation flaw in browser process
-
ImpactEscape sandbox to higher privilege
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process - this is a sandbox-escape primitive, not an initial-access bug, so a separate first-stage renderer exploit is a hard prerequisite. It further requires user interaction (UI:R): the victim must load an attacker-crafted HTML page in a vulnerable Chrome build prior to 151.0.7922.72. The exploited surface is Chrome's Passwords component reached over the renderer-to-browser IPC boundary. Limiting factors: no exploitation is possible against an already-patched browser, the required prior renderer compromise significantly narrows the realistic attacker set to those wielding a full exploit chain, and no authentication to any service is involved. |
| Impact | Signals conflict and must be weighed carefully. NVD assigns CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but the description explicitly states exploitation requires an attacker 'who had compromised the renderer process' - a substantial precondition the CVSS PR:N/AC:L metrics do not capture, which is why Chromium itself rates the severity only Medium. This is a second-stage sandbox-escape primitive, not a standalone remote code execution vector: it is valuable only as a link in a multi-bug exploit chain. EPSS is low (0.17%, 7th percentile), there is no KEV listing and no public exploit, consistent with a bug that is dangerous in the hands of a full chain author but not broadly or opportunistically exploited. Net real-world priority: patch promptly given Chrome's ubiquity and the browser's role as a primary attack surface, but the raw 9.6 overstates standalone risk - treat as high-value-but-preconditioned rather than an imminent mass-exploitation threat. |
| Exploit ScenarioDerived | An attacker first lands a separate renderer-compromise exploit when the victim visits a malicious or compromised web page, then uses this flaw to send crafted input from the controlled renderer to the browser process's Passwords handling and escape the sandbox into the higher-privileged process. Because UI:R applies, the victim must open the attacker's crafted HTML page. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, chaining into the higher-privileged browser process. The flaw stems from insufficient validation of untrusted input in the Passwords component (CWE-20) and is rated Medium by Chromium despite an NVD CVSS of 9.6. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel and restart the browser to apply it (Chrome auto-updates but requires a relaunch to complete); see the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through enterprise policy and confirm the effective version, and ensure Chromium-derived browsers pull the corresponding upstream fix. Because exploitation requires a prior renderer compromise, enabling and enforcing Chrome's site isolation and keeping renderer-facing components current reduces chain feasibility; where immediate updating is impossible, restricting browsing to trusted sites and deploying strict extension/content controls lowers the odds of the first-stage renderer bug that this issue depends on, at the cost of user convenience.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Chrome's Passwords subsystem, a browser-process feature that manages saved credential storage and autofill. Chrome runs untrusted web content in low-privilege renderer processes isolated by a sandbox; privileged operations are brokered to the browser process via Mojo/IPC. CWE-20 (Improper Input Validation) here means the browser process trusts data crossing that IPC boundary from the renderer without adequately validating it, so a renderer that an attacker already controls can send malformed input that the more-privileged process mishandles, producing a sandbox escape. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all desktop builds before the fixed release.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Kept AV:N/UI:R/S:C but raised to AC:H because a successful attack depends on first achieving a separate renderer compromise, a substantial precondition beyond a single request.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17834, CVSS 9.6) that enables privilege escalation from the renderer process to the higher-privileged browser process via malicious HTML content. Although no public exploit has been identified at time of analysis, this vulnerability undermines Chrome's fundamental security sandbox protecting systems from compromised web content. Organizations must immediately prioritize deployment of Chrome 151.0.7922.72 or later across all desktop endpoints to restore critical security controls.
Apply vendor patch: Chrome version 151.0.7922.72 or later. No interim mitigations available; sandbox escape cannot be remediated without patching.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB