EUVD-2026-50639
GHSA-gc7w-qpqq-h9x5
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
AC:H reflects mandatory renderer pre-compromise; S:C captures sandbox escape; C/I/A:L follows vendor's conservative scoping of the escape's host impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome DevTools prior to version 151.0.7922.72 requires a pre-compromised renderer process and user interaction with a crafted HTML page to break out of the browser sandbox. The root cause is insufficient input validation (CWE-20) in the DevTools component, where attacker-controlled input from the renderer is not properly sanitized before being processed. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.18%, indicating low observed exploitation pressure despite the meaningful impact of a successful sandbox escape.
Technical ContextAI
Google Chrome's multi-process security architecture isolates web content inside a sandboxed renderer process. DevTools - Chrome's built-in developer tooling - bridges the renderer and the browser process, processing data and commands that may originate from web content. CWE-20 (Improper Input Validation) in DevTools means that data arriving from the renderer is accepted without adequate sanitization or bounds checking, allowing a compromised renderer to send crafted inputs that influence privileged DevTools logic. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions prior to 151.0.7922.72. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:C reflects the scoped impact - a successful exploit crosses security boundaries from the sandboxed renderer into the broader system context, hence S:C.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, available via the Chrome stable channel update announced at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates; users should verify their version at chrome://settings/help and force an update if needed. As a compensating control pending update, disabling or restricting access to Chrome DevTools in managed enterprise environments (via the DevToolsDisabled policy) would eliminate the vulnerable attack surface but at the cost of removing developer and diagnostic functionality. Organizations running Chromium-based embedded browsers should track the upstream Chromium fix referenced at https://issues.chromium.org/issues/524029061 and apply vendor-specific patches accordingly.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today