EUVD-2026-65764
GHSA-79jp-m6vw-2f5h
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects mandatory renderer pre-compromise; S:C captures sandbox escape to host; full C/I/A:H because post-escape code runs outside sandbox constraints.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Type confusion in Accessibility in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape via type confusion in Google Chrome's Accessibility component on Windows enables arbitrary code execution outside the browser sandbox. Affecting all Chrome versions prior to 152.0.7977.65 on Windows, the flaw requires an attacker to have already compromised the renderer process - making this a critical second-stage exploit in a multi-step attack chain. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two chained conditions: first, the attacker must have already compromised the Chrome renderer process through a separate, unspecified vulnerability - the renderer compromise is an explicit prerequisite stated in the CVE description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.3 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) accurately captures the high severity but also the non-trivial exploitation complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor first exploits a separate renderer-level vulnerability (e.g., a V8 JavaScript engine bug) via a crafted HTML page visited by a targeted user, gaining code execution within Chrome's sandboxed renderer process. With the renderer compromised, the attacker then triggers the type confusion flaw in Chrome's Windows Accessibility component, causing the browser to mishandle object types across the sandbox boundary. … |
| Remediation | Upgrade Google Chrome on all Windows endpoints to version 152.0.7977.65 or later, which contains the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows devices running Chrome versions prior to 152.0.7977.65 using your endpoint management system or asset inventory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today