EUVD-2026-50602
GHSA-2gvw-rh95-856r
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AC:H reflects the hard prerequisite of a compromised renderer process; all other metrics align with network delivery, scope change to DevTools, and limited XSS impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Script and HTML injection into privileged DevTools pages in Google Chrome prior to 151.0.7922.72 is enabled when an attacker has already compromised the renderer process, exploiting an inappropriate implementation in DevTools (CWE-79). The vulnerability requires chaining with a prior renderer exploit: alone it cannot be triggered by a remote unauthenticated attacker without that precondition, making it a sandbox-escape amplifier rather than a standalone remote attack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two distinct preconditions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) captures the scope change to a privileged context and the network delivery pathway but understates attack complexity: the description explicitly requires a prior renderer compromise, a significant precondition that elevates real-world attack complexity well beyond AC:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already exploited a separate renderer process vulnerability in Chrome crafts a malicious HTML page that leverages the DevTools implementation flaw to inject attacker-controlled script into a privileged DevTools page when the victim visits the attacker-controlled site. The injected script executes within the elevated DevTools context, potentially accessing internal Chrome debugging APIs beyond the renderer sandbox's normal reach. … |
| Remediation | The primary fix is to update Google Chrome to version 151.0.7922.72 or later, which is available via Chrome's built-in auto-update mechanism or the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today