EUVD-2026-50647
GHSA-3928-85xc-vfvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConvince user to install malicious extension
-
ExploitExtension abuses DevTools protocol
-
ExecutionTrigger use-after-free in DevTools
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to install an attacker-supplied malicious Chrome Extension that then abuses the DevTools component to trigger the use-after-free - the extension is the concrete prerequisite named in the description. Limiting factors: user interaction is mandatory (installing/approving the extension, matching CVSS UI:R), attack complexity is high (AC:H), the affected version must be Chrome prior to 151.0.7922.72, and resulting code execution is contained within the browser sandbox (no direct OS-level compromise without a separate sandbox-escape chain). Enterprises that block untrusted extension installation are effectively not exposed. |
| Impact | Signals are mostly consistent toward low real-world risk despite the 7.5 CVSS. The CVSS vector (AV:N/AC:H/PR:N/UI:R) reflects network reachability but high complexity and required user interaction, and Chromium's own severity rating is Low because impact is contained within the sandbox (S:U - no scope change to the OS). EPSS is 0.13% (3rd percentile) and there is no KEV listing and no identified public exploit, all reinforcing low likelihood of widespread exploitation. The main tension is between the high C:H/I:H/A:H impact metrics and the description's explicit 'inside a sandbox' containment plus the malicious-extension precondition - the raw CVSS overstates practical severity, and the requirement that a victim first install an attacker-controlled extension is a substantial barrier. No SSVC decision data was provided. |
| Exploit ScenarioDerived | An attacker publishes or side-loads a Chrome extension containing code that abuses the DevTools protocol to trigger the use-after-free. After social-engineering a user into installing the extension, the attacker gains arbitrary code execution confined to the browser sandbox on an unpatched Chrome. The high attack complexity and required user interaction (CVSS AC:H/UI:R) make this an opportunistic rather than reliable mass-exploitation vector, and no public exploit code has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandboxed arbitrary code execution in Google Chrome's DevTools component affects all desktop builds prior to 151.0.7922.72, where a use-after-free (CWE-416) can be triggered by a crafted Chrome Extension. An attacker must first convince the victim to install a malicious extension, after which they can run code confined to the browser sandbox. Chromium rated this Low severity; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.13%, 3rd percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel (Chrome auto-updates on relaunch; force it under Settings > About Google Chrome and restart), per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation depends on the victim installing a malicious extension, the most effective compensating control until patching completes is to restrict extension installation - enforce an enterprise extension allowlist/blocklist via the ExtensionInstallAllowlist/ExtensionInstallBlocklist group policies and disable developer-mode extension loading; the trade-off is reduced user flexibility in adding extensions. Auditing and removing untrusted installed extensions further reduces exposure with minimal operational impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome DevTools, the built-in developer tooling exposed to extensions via the debugger/DevTools protocol APIs. The root cause is a use-after-free (CWE-416): a memory object tied to DevTools is freed while a reference to it remains live, and a crafted extension can drive DevTools into re-accessing the dangling pointer to corrupt memory and hijack control flow. Per the CPE (cpe:2.3:a:google:chrome:*) this affects the Chrome application across platforms; exploitation is scoped to the renderer/DevTools sandbox rather than the privileged browser process, which is why arbitrary code runs 'inside a sandbox' rather than at OS privilege.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Requires social-engineered malicious extension install (UI:R, AC:H); code stays within the sandbox so impacts are Low, not High, consistent with Chromium's Low rating.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions before 151.0.7922.72 contain a code execution vulnerability affecting all desktop users; no public exploit identified at time of analysis, and exploitation requires users to install a malicious extension and is confined to the browser sandbox, resulting in minimal real-world organizational risk (0.13% likelihood per EPSS).
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB