EUVD-2026-65829
GHSA-7cgc-c3w7-v722
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network delivery via HTML page, race condition complexity (AC:H), no target-system privileges needed, user must render the page, sandbox escape changes scope with full host impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Race condition in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape via GPU race condition in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox through a crafted HTML page. The flaw is a time-of-check-to-time-of-use (TOCTOU) race condition (CWE-367) in Chrome's GPU component, classified Medium severity by the Chromium team despite a CVSS score of 8.3 - reflecting the mandatory renderer pre-compromise prerequisite that makes this a chained exploit rather than a standalone attack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has ALREADY achieved compromise of the Chrome renderer process through a separate, independent vulnerability before this flaw can be triggered - this CVE is a sandbox escape primitive and cannot be exploited standalone. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects scope-changed, full-impact exploitation, but the Chromium security team's own Medium rating is the more operationally relevant signal - it explicitly accounts for the renderer pre-compromise prerequisite that CVSS cannot fully express. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first delivers a separate renderer exploit - for example, a JavaScript engine memory corruption bug - to compromise Chrome's renderer process while a victim visits a malicious or attacker-controlled website. With renderer access established, the attacker presents a crafted HTML page that triggers concurrent GPU operations, exploiting the TOCTOU race window in the GPU component to corrupt shared state. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later immediately, as a vendor-released patch is confirmed available via the Chrome Stable Channel Update advisory at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Chrome installations to identify systems running versions prior to 152.0.7977.65 and assess user exposure to renderer-compromising attack vectors. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today