EUVD-2026-50586
GHSA-5563-95wf-5c3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate exploit
-
DeliveryServe crafted HTML to DevTools path
-
ExploitTrigger CWE-20 input-validation flaw
-
ExecutionEscape Chrome sandbox (scope change)
-
ImpactExecute in higher-privilege browser process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (a prior, separate exploit) - this is the explicit precondition stated in the CVE, not an optional detail. From that foothold, the attacker must deliver a specially crafted HTML page that triggers the DevTools input-validation flaw, and the CVSS vector's UI:R indicates victim user interaction is involved (visiting/loading attacker content). Limiting factors: the vulnerability is not exploitable against a clean target on its own, is confined to Chrome versions prior to 151.0.7922.72, and the required renderer-compromise chain plus Chromium's 'Medium' rating and 0.17% EPSS all point to targeted, chained use rather than opportunistic mass exploitation. |
| Impact | The signals here conflict and must be weighed together. NVD assigns CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this rating does not model the explicit precondition in the description - the attacker must have ALREADY compromised the renderer process. Google's own Chromium program rated the severity only 'Medium,' and EPSS is very low at 0.17% (7th percentile), indicating little expectation of near-term mass exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis. The realistic risk is that of a chain component: dangerous when paired with a separate renderer RCE, but not independently exploitable against a fresh target. The PR:N in the CVSS vector is misleading - verify against the description, which requires a prior renderer compromise, so raw CVSS overstates standalone risk. |
| Exploit ScenarioDerived | An attacker first uses a separate renderer exploit (e.g., a JavaScript engine bug) to gain code execution inside Chrome's sandboxed renderer when a victim visits a malicious site. Leveraging this foothold, the attacker serves a crafted HTML page that abuses the DevTools input-validation flaw to escape the sandbox and execute in the higher-privilege browser context. No public proof-of-concept has been identified at time of analysis, and success depends on chaining with a prior renderer compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sandbox escape in Google Chrome's DevTools (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the sandbox and gain broader host access via a crafted HTML page. It stems from insufficient validation of untrusted input (CWE-20) and requires user interaction plus a pre-existing renderer foothold, so it functions as a second-stage exploit rather than a standalone entry point. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with Chromium's internal 'Medium' severity rating despite the high NVD CVSS score.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the stable channel, as announced at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html; restart the browser to ensure the update is applied since Chrome staging can leave older processes running. In managed fleets, push the update through your enterprise browser management (Google Admin console / group policy) and confirm minimum-version enforcement. Because this is a sandbox-escape that only matters after a renderer compromise, defense-in-depth measures such as enabling the enhanced/strict site-isolation and 'Enhanced Protection' Safe Browsing settings reduce the likelihood of the preceding renderer exploit; there is no need for a feature-specific workaround since patching is straightforward and widely available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome DevTools, the built-in debugging and inspection subsystem of the Chromium browser engine (cpe:2.3:a:google:chrome). Chromium uses a multi-process architecture in which untrusted web content runs inside a heavily sandboxed renderer process, while higher-privilege operations are handled by the browser/broker process; the sandbox boundary is the core defense that contains renderer compromises. This vulnerability is a CWE-20 Improper Input Validation issue in which DevTools fails to properly validate untrusted input crossing that trust boundary, enabling a scope change (S:C) where a compromised renderer can influence resources outside its sandbox. Sandbox-escape bugs are impactful because they convert a contained renderer exploit into full-browser or host-level compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H because exploitation depends on a prior renderer compromise and crafted content; UI:R and S:C reflect victim interaction and the sandbox-boundary escape; full C/I/A impact on escape.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome DevTools sandbox escape (affecting versions before 151.0.7922.72) poses an escalation risk by allowing compromised renderer processes to gain host-level system access. The vulnerability requires attackers to first breach the browser renderer, making it a secondary rather than primary attack vector, but significantly amplifies the impact of browser-based compromises. Organizations should prioritize patching to break this privilege escalation chain.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB