EUVD-2026-54142
GHSA-fcm2-mhcw-725j
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects mandatory renderer pre-compromise prerequisite; S:C and C/I/A:H reflect full sandbox escape to OS-level access.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome prior to 151.0.7922.109 enables a remote attacker who has already compromised the renderer process to break out of Chrome's OS-level security sandbox via a crafted HTML page. This is a second-stage, chained vulnerability - not directly exploitable in isolation - making it a high-value component in multi-step browser attacks that pair a renderer exploit with this UI input validation flaw to achieve full OS-level code execution. No public exploit has been identified and SSVC rates exploitation status as none at time of analysis, though the total technical impact and confirmed scope change (S:C) make this a critical priority when chained with any renderer compromise.
Technical ContextAI
Google Chrome uses a multi-process, sandboxed architecture: renderer processes (responsible for parsing HTML, running JavaScript) are isolated from the OS and from the privileged browser process via Chrome's sandbox. CWE-20 (Improper Input Validation) in this context means the browser process UI layer fails to sufficiently validate untrusted data received from the renderer process over IPC (Inter-Process Communication). Because the browser process holds elevated OS trust relative to the renderer sandbox, an attacker controlling a compromised renderer can craft IPC messages or HTML constructs that exploit this gap to influence browser-process behavior and escape the sandbox boundary. The Chromium security team rated this High severity. Affected CPE maps to Chrome versions prior to 151.0.7922.109 on all desktop platforms (Windows, macOS, Linux) per EUVD-2026-54142.
RemediationAI
Update Google Chrome to version 151.0.7922.109 or later via the browser's built-in update mechanism (Settings > Help > About Google Chrome) or through enterprise deployment channels. The patch is confirmed available from Google per the Stable Channel update advisory at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Because exploitation requires a pre-compromised renderer as a prerequisite, organizations unable to patch immediately should prioritize mitigations that reduce renderer compromise risk: enforce Chrome's Site Isolation feature (enabled by default in modern Chrome, verify via chrome://flags/#site-isolation-trial-opt-out), restrict access to untrusted or high-risk web content via proxy filtering, and consider enabling Chrome Enhanced Protection mode (Settings > Privacy and Security > Safe Browsing). Note that these compensating controls address the prerequisite renderer-compromise stage, not this specific flaw directly. Disabling JavaScript broadly is a high-friction workaround that prevents most renderer exploits but breaks legitimate web functionality.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today