EUVD-2026-50895
GHSA-xxfq-g4g6-2pwg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers Passwords implementation flaw
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactImpact confined to sandbox context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-controlled crafted HTML page in an unpatched Chrome (UI:R user interaction is mandatory), so this is not a zero-click flaw. No authentication is needed (PR:N) and it works against default configurations, but the resulting code execution is explicitly confined to the renderer sandbox (S:U) - meaning an attacker gains no host-level control without chaining a separate sandbox-escape vulnerability, which is the primary factor limiting real-world impact and the reason Chromium rated it Low. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects network-reachable, low-complexity, unauthenticated exploitation requiring only that the user open a page, with high confidentiality/integrity/availability impact. However, Chromium's own security team rated this Low, and the description explicitly scopes the code execution to 'inside a sandbox' with S:U (no scope change) - a strong signal that real-world impact is contained and that the 8.8 overstates practical severity absent a chained sandbox escape. No EPSS score, SSVC decision, KEV listing, or POC was provided, so there is no evidence of active exploitation. Net: patch on the normal Chrome update cadence rather than as an emergency, since the CVSS-versus-vendor-severity conflict here favors the vendor's Low given that sandbox containment materially limits the blast radius. |
| Exploit ScenarioDerived | An attacker hosts a malicious HTML page and entices a Chrome user to visit it via a link, ad, or compromised site; the page triggers the Passwords component flaw and runs attacker code inside the renderer sandbox. Because UI:R is required, the victim must open the page, and the executed code remains confined to the sandbox unless combined with a separate escape; no public POC was identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution within the browser's renderer sandbox affects Google Chrome desktop builds prior to 151.0.7922.72, stemming from an inappropriate implementation in the Passwords component (CWE-269). A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code, but execution is confined to the sandbox - which is why Chromium rated the underlying issue Low severity despite the CVSS 8.8. No public exploit identified at time of analysis, and the fix is already shipping in the Stable channel.
RemediationAI
Vendor-released patch: Google Chrome 151.0.7922.72. Update to 151.0.7922.72 or later via the Stable desktop channel and relaunch the browser to apply it, then confirm the version under chrome://settings/help; managed fleets should push the update through their existing browser management or MDM tooling per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). No standalone workaround is published; as an interim compensating control, ensure Chrome's sandbox is not disabled (avoid the --no-sandbox flag) and limit users from visiting untrusted sites, accepting that this restricts functionality but preserves the containment that keeps this bug low-impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chrome is a Chromium-based web browser whose renderer processes run inside a multi-layer OS sandbox designed to contain code execution triggered by untrusted web content. This flaw lives in the Passwords feature (credential storage/autofill) and is classified CWE-269 (Improper Privilege Management), indicating the component acts with or grants privileges it should not when processing attacker-influenced input. The affected CPE is cpe:2.3:a:google:chrome:*, covering the desktop application across platforms; because the arbitrary code executes 'inside a sandbox,' the attacker gains control only over the confined renderer context and would need to chain a separate sandbox-escape bug to reach the host OS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with required user interaction and no auth (AV:N/AC:L/PR:N/UI:R), but code runs only inside the sandbox with no scope change, so impacts are Low rather than High.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
All Google Chrome desktop browsers below version 151.0.7922.72 are vulnerable to remote code execution attacks through malicious websites, risking employee workstation compromise and credential theft-a critical exposure given Chrome's prevalence in enterprise environments. Although execution is limited to the browser process, the business impact includes potential unauthorized data access and malware distribution. A patch is available through Chrome's Stable channel and should be deployed enterprise-wide within 7 days.
Apply vendor patch: Google Chrome version 151.0.7922.72 or later (available in Stable channel).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB