EUVD-2026-50602
GHSA-2gvw-rh95-856r
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AC:H reflects the hard prerequisite of a compromised renderer process; all other metrics align with network delivery, scope change to DevTools, and limited XSS impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Script and HTML injection into privileged DevTools pages in Google Chrome prior to 151.0.7922.72 is enabled when an attacker has already compromised the renderer process, exploiting an inappropriate implementation in DevTools (CWE-79). The vulnerability requires chaining with a prior renderer exploit: alone it cannot be triggered by a remote unauthenticated attacker without that precondition, making it a sandbox-escape amplifier rather than a standalone remote attack. EPSS is 0.18% (8th percentile), no public exploit has been identified, and it does not appear in CISA KEV, reflecting low observed exploitation pressure despite the Medium CVSS rating.
Technical ContextAI
Google Chrome's DevTools interface runs in a privileged browsing context with elevated access to internal Chrome APIs and debugging capabilities. The underlying flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting): DevTools fails to properly sanitize or isolate content injected from the renderer process, allowing attacker-controlled scripts or HTML to execute within the privileged DevTools page. The renderer process in Chrome is normally sandboxed, but a prior renderer compromise - via a separate vulnerability - can be leveraged to supply crafted content that this DevTools implementation incorrectly trusts and renders. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome stable builds prior to 151.0.7922.72 across platforms. Chromium classified this as Medium severity, consistent with the scope-changing but limited-impact nature of privileged-page XSS.
RemediationAI
The primary fix is to update Google Chrome to version 151.0.7922.72 or later, which is available via Chrome's built-in auto-update mechanism or the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. This patch resolves the inappropriate DevTools implementation that permitted script injection from a compromised renderer. Because exploitation requires an already-compromised renderer process, organizations that cannot immediately deploy the update should prioritize mitigating renderer-level vulnerabilities through Chrome's existing sandbox hardening features - enabling strict site isolation (--site-per-process, enabled by default in modern Chrome) and restricting DevTools access to trusted administrators only via enterprise policy (DevToolsAvailability GPO setting). Restricting DevTools access eliminates the privileged injection surface entirely, though it prevents legitimate developer use. No significant side effects are expected from the patch itself.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today