EUVD-2026-50873
GHSA-9474-jh72-xhvr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage opens WebSocket via JavaScript
-
ExploitTrigger use-after-free in WebSockets
-
ExecutionGroom freed heap memory
-
PersistEscape renderer sandbox
-
ImpactExecute code in browser context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open an attacker-controlled or compromised HTML page in a vulnerable Chrome build prior to 151.0.7922.72 (UI:R user interaction is mandatory - there is no zero-click path). The malicious page must exercise the WebSockets API to trigger the use-after-free, so a functioning WebSocket flow must reach the affected code. No authentication and no special browser configuration are needed (PR:N), but the escape depends on successfully grooming freed heap memory to convert the UAF into a sandbox escape, which Google characterizes as only 'potential' - the primary limiting factors are the required user interaction, the reliability of the memory-corruption primitive, and that the bug is not automatable per SSVC. |
| Impact | The signals are notably conflicting. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) reflects a network-reachable, low-complexity, unauthenticated bug whose scope-change (S:C) sandbox escape yields total confidentiality, integrity, and availability impact. However, Google's own Chromium team rated the security severity as Low, and the SSVC decision framework reports Exploitation: none, Automatable: no, Technical Impact: total - meaning the impact if exploited is severe but there is no evidence of exploitation and it is not readily automatable. EPSS is only 0.17% (7th percentile), and it is not on CISA KEV. The description also hedges with 'potentially perform a sandbox escape,' indicating the escape is theoretical rather than demonstrated. Net: this is a patch-in-normal-cycle browser bug rather than an emergency; the 9.6 headline number overstates real-world urgency given no exploit, low EPSS, and Google's own Low rating. The tension between CVSS Critical and Chromium Low should be resolved in favor of the practical signals (SSVC/EPSS) for prioritization, while still patching promptly because browsers are ubiquitous. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript that opens and manipulates a WebSocket to trigger the use-after-free, then lures a victim to visit it (satisfying the UI:R user-interaction requirement). By grooming the freed heap memory, the attacker attempts to corrupt state that lets code escape the renderer sandbox toward the browser process. No public exploit code has been identified, and Google describes the escape only as 'potential.' |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's WebSockets implementation (versions prior to 151.0.7922.72) allows a remote attacker to potentially break out of the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 9.6 due to a scope-changing sandbox escape, though Google's own Chromium severity rating is only Low and EPSS exploitation probability is minimal (0.17%). No public exploit has been identified and CISA SSVC lists exploitation status as none.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the desktop stable channel, as announced in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome normally auto-updates, so verify the version under chrome://settings/help and relaunch to apply. Enterprises managing Chrome via policy should push the updated build and force a browser restart to ensure the fix takes effect. There is no vendor-documented configuration workaround, but interim risk can be reduced by ensuring the browser sandbox is not disabled (never run with --no-sandbox) and by using web filtering to limit exposure to untrusted pages that could deliver a crafted WebSocket payload - noting these measures reduce but do not eliminate exposure and are no substitute for the update. Downstream Chromium-based browsers should be updated once they ship a build incorporating the upstream fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Chrome's WebSockets subsystem, the browser API that maintains full-duplex TCP connections between JavaScript in a web page and a remote server. The root cause is a use-after-free (CWE-416): a heap object tied to a WebSocket is freed while a dangling pointer to it remains reachable, so subsequent access operates on reclaimed or attacker-controlled memory. Because WebSocket handling spans the sandboxed renderer and browser-process boundary, a controlled UAF here is what elevates the issue from a renderer-only bug to a potential sandbox escape. The affected product per CPE is cpe:2.3:a:google:chrome (all versions below the fixed build), i.e. the desktop Chrome stable channel on the Blink/Chromium engine.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable via a crafted page with required user interaction and no auth, but reliably weaponizing a heap UAF into a sandbox escape raises complexity to AC:H; scope changes on sandbox escape with full impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17947, CVSS 9.6) enabling arbitrary code execution when users visit malicious web pages. While no public exploitation has occurred and real-world exploit probability is minimal (0.2% EPSS), the vulnerability's severity and Chrome's ubiquitous deployment across the organization demand immediate action.
Apply vendor patch: Chrome 151.0.7922.72 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB