EUVD-2026-66003
GHSA-5724-75rm-8cxv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted HTML page, no attacker privileges, UI:R for mandatory social engineering, S:U for sandbox containment, C/I/A:H for arbitrary in-sandbox code execution.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Insufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Insufficient control flow management in Google Chrome's DevTools component (versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code inside the browser sandbox by tricking a user into loading a crafted HTML page via social engineering. The flaw is rooted in CWE-691 and permits attacker-controlled code paths within the DevTools subsystem, with execution constrained to within the Chrome sandbox (S:U). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running Google Chrome prior to version 152.0.7977.65 and to be successfully persuaded via social engineering to navigate to a crafted HTML page - CVSS UI:R confirms that user interaction is mandatory and non-bypassable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 base score reflects high C/I/A impact with a network attack vector and no privilege requirement, but UI:R (mandatory user interaction via social engineering) and S:U (sandbox-contained scope) meaningfully reduce real-world risk compared to a no-interaction, scope-changing flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page engineered to trigger the control flow defect in Chrome's DevTools subsystem, then uses phishing email, malicious advertising, or social media link-sharing to direct a target running an unpatched Chrome instance to the page. Upon the victim loading the page, the DevTools vulnerability fires and enables execution of attacker-controlled code within the Chrome sandbox. … |
| Remediation | Upgrade Google Chrome to version 152.0.7977.65 or later, the vendor-released patch confirmed via the Chrome stable channel release blog at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit Chrome version distribution across the organization and prepare patch deployment communications to all users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-691 – Insufficient Control Flow Management
View allShare
External POC / Exploit Code
Leaving vuln.today