EUVD-2026-50637
GHSA-4g93-9mx8-6qjj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network position
-
DeliverySend malicious network traffic to WebUI
-
ExploitTrigger improper input validation
-
ExecutionEscape renderer sandbox
-
ImpactAchieve partial code execution/impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires (1) an unpatched Chrome build prior to 151.0.7922.72, (2) an adjacent-network position per CVSS AV:A - the attacker must reach the victim over the local/adjacent network (same LAN/broadcast domain or link-local scope), not the open internet, and (3) delivery of malicious network traffic that reaches the vulnerable WebUI component whose insufficient input validation is the flaw. Limiting factors: the adjacent-network requirement excludes remote internet-only attackers; impact is only partial (C:L/I:L/A:L) and the description says the sandbox escape is 'potentially' achievable, so a full escape is not guaranteed; no authentication or user interaction is needed (PR:N/UI:N), so within the adjacent network there is no user-action barrier. |
| Impact | Signals are consistent and point to moderate, not urgent, risk. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L, base 7.1) shows an adjacent-network attack requiring no privileges or user interaction with a scope change (the sandbox escape) but only Low impact to each of confidentiality, integrity and availability. EPSS is low at 0.17% (6th percentile) and CISA SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - all reinforcing that this is not currently weaponized. The 'Potential RCE' tag reflects worst-case potential of a sandbox escape rather than a demonstrated exploit; the description itself says 'potentially perform a sandbox escape.' The AV:A (adjacent) rating is notable: exploitation requires a network-adjacent position (same LAN/broadcast domain) rather than arbitrary internet-based attack, which meaningfully limits real-world reach. Net: a Medium-severity, patch-available browser bug that should be remediated on the normal Chrome auto-update cadence rather than treated as an emergency. |
| Exploit ScenarioDerived | An attacker who has gained a foothold on the same local network segment (e.g., a compromised device on a corporate LAN or shared Wi-Fi) sends crafted malicious network traffic that reaches a vulnerable WebUI surface in an unpatched Chrome instance. Exploiting the improper input validation, the attacker attempts to escape the renderer sandbox to gain higher-privilege execution. No public proof-of-concept has been identified at time of analysis, and the CVSS low-complexity/no-interaction profile means a successful exploit would need no victim action once the attacker holds the adjacent position. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from insufficient validation of untrusted input in a WebUI component, letting a remote attacker on the same network segment potentially break out of the renderer sandbox via malicious network traffic. Google rates the Chromium severity as Medium and vendor-tagged intelligence flags it as 'Potential RCE'; a vendor patch is available, but no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile). CISA SSVC records no observed exploitation and only partial technical impact.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 - upgrade to that Stable channel build or later on all desktop platforms, then fully relaunch the browser so the new binary loads (Chrome staged updates do not take effect until restart). Verify via chrome://settings/help and, in managed fleets, confirm the auto-update policy is enabled and not pinned to an older version. Details are in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation is network-adjacent, an interim compensating control is to keep untrusted devices off the same LAN segment as sensitive workstations and restrict/monitor local network traffic to browsers; this reduces the adjacent-attacker surface but does not fix the underlying WebUI validation flaw, so patching remains the durable remedy.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chrome's WebUI is the internal chrome:// interface layer (settings, downloads, new-tab, etc.) implemented with privileged HTML/JS bindings that bridge the sandboxed renderer to higher-privilege browser-process functionality. The root cause is CWE-20 (Improper Input Validation): a WebUI surface accepts network-sourced data without adequately validating it, and because WebUI pages hold Mojo/browser-process bindings, a validation gap there can be leveraged to cross the renderer sandbox boundary. The single affected CPE is cpe:2.3:a:google:chrome:*, i.e. the Chrome desktop browser application across affected builds prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Description states adjacent malicious network traffic (AV:A) with no auth or interaction (PR:N/UI:N); a sandbox escape crosses a trust boundary (S:C) with partial, not total, impact (C/I/A:L).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop versions before 151.0.7922.72 contain a sandbox escape vulnerability (CVE-2026-17888, CVSS 7.1) exploitable by network-adjacent attackers to achieve remote code execution through malicious network traffic. No public exploit identified at time of analysis, and CISA reports no observed exploitation; however, the vulnerability's widespread presence across organizational Chrome deployments requires prompt patching.
Apply vendor patch to Chrome 151.0.7922.72 or later. For endpoints requiring extended patching windows, restrict Chrome to trusted network access only and consider disabling automatic WebUI component feature loading pending patch deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB