EUVD-2026-50905
GHSA-h8h7-r9hg-ph8f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitMalicious JS triggers V8 race condition
-
ExecutionWin timing race to corrupt engine state
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open an attacker-controlled crafted HTML page in a vulnerable Chrome build (< 151.0.7922.72) - user interaction is mandatory (UI:R), so there is no drive-by against an idle browser without a visit. The attack further depends on winning a concurrency race in V8 (AC:H), which is non-deterministic and may require many attempts, and the resulting code execution is confined to the renderer sandbox - a full host compromise would require chaining a separate sandbox-escape vulnerability. No authentication or special browser configuration is required (PR:N, default configuration), but the race-timing dependency and mandatory page visit are the key limiting factors. |
| Impact | The signals here are consistent and point to a lower real-world priority than the 7.5 base score alone suggests. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) shows network reach and no privileges required, but High attack complexity (AC:H - the attacker must win a race) and required user interaction (UI:R - the victim must visit a malicious page). CISA's SSVC framework assesses Exploitation as none and Automatable as no, while Technical Impact is total; combined, that indicates a serious-if-triggered bug that is neither being exploited nor easily weaponized at scale. Google's own Chromium severity rating is Low. No KEV listing, no POC, and no EPSS score were provided. The one point worth verifying is that the description limits impact to 'inside a sandbox,' which is more contained than the C:H/I:H/A:H triad implies for a full compromise - the scored impact reflects renderer-process compromise, not host takeover. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted JavaScript designed to trigger the V8 race condition and entices a victim to visit it via phishing, malvertising, or a compromised site. If the timing race is won, the attacker gains arbitrary code execution within the victim's renderer sandbox; no public exploit is identified at time of analysis, and the High attack complexity plus required user interaction make reliable exploitation difficult. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome's V8 JavaScript engine (all versions prior to 151.0.7922.72) allows a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though confined inside the renderer sandbox rather than achieving a full sandbox escape. Google rated the Chromium security severity as Low, and there is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation status: none). Exploitation hinges on winning a timing race, so despite the 7.5 CVSS score it is regarded as difficult to trigger reliably.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; the fix is described in Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because Chrome auto-updates, most endpoints will receive the fix on next relaunch, so the primary compensating control is to force a browser restart across the fleet rather than waiting for background updates, and to verify the installed version via chrome://settings/help. Users of other Chromium-based browsers should apply their vendor's corresponding update once it rebases on the patched V8. As an interim measure for high-risk users, restricting untrusted-site browsing or enabling site isolation reduces exposure, but these do not fully substitute for the patch and carry usability trade-offs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in V8, the JavaScript and WebAssembly engine that powers Chrome and all Chromium-derived browsers. The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e. a race condition): concurrently executing code paths access a shared resource without adequate locking, letting an attacker manipulate memory state during the window between check and use to corrupt engine internals and gain code execution. Per the CPE data (cpe:2.3:a:google:chrome), the affected component is the desktop Chrome application; because V8 is shared upstream, other Chromium-based browsers (Edge, Brave, Opera, Vivaldi, Electron apps) likely inherit the same defect until they rebase on the fixed V8. Crucially, the described impact is code execution 'inside a sandbox,' meaning the compromise is contained to the renderer process and CVSS scope is Unchanged (S:U) - a separate sandbox-escape bug would be required to reach the host OS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted page is network-reachable (AV:N) but needs a victim visit (UI:R) and winning a race (AC:H); code runs in the renderer sandbox so scope is unchanged (S:U).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability in the V8 JavaScript engine that enables attackers to execute code within the browser's renderer sandbox by enticing users to visit malicious web pages. While the sandbox limits full system compromise, unpatched Chrome installations across the enterprise remain at risk, and the vulnerability affects all users until updates are deployed.
Apply vendor patch: Chrome 151.0.7922.72.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Implementation and Policy Flaws
View all 50Same weakness CWE-362 – Race Condition
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB