EUVD-2026-54271
GHSA-vjrx-hgqp-mr6x
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AV:N for web-delivered payload; AC:H for mandatory renderer pre-compromise; PR:N as no system auth is required; UI:R for crafted page visit; S:C and C/I/A:H for full host OS impact post-sandbox-escape.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Heap buffer overflow in the CrashReporting component of Google Chrome prior to 151.0.7922.109 enables sandbox escape when an attacker has already compromised the renderer process and can deliver a crafted HTML page. The CVSS scope change (S:C) and total technical impact rating confirm full host system compromise is achievable as the second stage of a chained exploit. No public exploit code or active exploitation has been identified at time of analysis, per SSVC exploitation status of 'none' and absence from CISA KEV.
Technical ContextAI
CWE-122 (Heap-based Buffer Overflow) describes a write operation that exceeds the allocated heap region - in this case within Chrome's CrashReporting subsystem. Chrome's multi-process architecture isolates the renderer (which parses HTML/JS) from the browser process and OS via a sandbox. CrashReporting handles telemetry and crash signal processing; a heap overflow there, triggered from within a compromised renderer context, can corrupt adjacent heap metadata or function pointers in the more privileged browser or GPU process, enabling a controlled write primitive sufficient to break sandbox isolation. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:C confirms the cross-boundary scope change: exploitation crosses from the renderer security context into the host OS. Affected CPE is derived from the EUVD entry covering Chrome versions below 151.0.7922.109.
RemediationAI
Update Google Chrome to version 151.0.7922.109 or later, as documented in the vendor's stable channel release advisory (http://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html). Chrome's auto-update mechanism will deliver this patch automatically in most enterprise and consumer deployments; administrators should verify update policy compliance and force-push via MDM or group policy where auto-update is restricted. No workaround fully mitigates a heap overflow in the renderer-adjacent CrashReporting path, but reducing the attack surface by blocking access to untrusted or external web content through web proxies or application allowlisting reduces renderer compromise exposure upstream of this vulnerability. Disabling Chrome's crash reporting via enterprise policy (MetricsReportingEnabled=false) may limit the attack surface of this specific component, but this has not been confirmed as a complete mitigation by Google and should not substitute for patching.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today