EUVD-2026-65974
GHSA-mw59-gfc6-3gx2
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
S:C assigned instead of S:U because sandbox escape crosses a security boundary by definition; AC:H and PR:N retained as renderer compromise is a prerequisite raising complexity, not requiring attacker privileges.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome's Media component (prior to 152.0.7977.65) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Google has released a patched stable channel build (152.0.7977.65), with no public exploit code or active exploitation confirmed at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has already achieved code execution within Chrome's renderer process as a mandatory prerequisite - this CVE is a sandbox escape, not an initial-access vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.5) contains a notable inconsistency: S:U (unchanged scope) conflicts with the described sandbox escape behavior, which by definition crosses a security boundary and would normally warrant S:C (changed scope). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first exploits a separate renderer-level vulnerability - such as a memory corruption bug triggered by a malicious webpage - to gain code execution within Chrome's sandboxed renderer process. With renderer access established, the attacker loads a crafted HTML page that invokes the flawed Media component workflow, triggering the sandbox escape and achieving code execution at the privilege level of the outer browser process on the victim's host OS. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later, which is the vendor-confirmed patched release per the stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Chrome versions prior to 152.0.7977.65 and assess exposure levels, particularly development and browsing-intensive environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today