EUVD-2026-74499
GHSA-8fxm-x2p7-6556
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered crafted page needs no auth but requires the victim to open it (UI:R); sandbox escape crosses a trust boundary (S:C) with full code execution (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox-escape remote code execution in Google Chrome (Chromium-based desktop) before 153.0.8010.36 stems from an incorrect authorization flaw in the DevTools component. A remote attacker who lures a victim to a crafted HTML page can potentially execute arbitrary code outside the renderer sandbox, achieving full compromise of the browser process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a crafted HTML page in a vulnerable Google Chrome build (prior to 153.0.8010.36) - that user interaction (UI:R) is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting a page) and results in a scope change with high impact on confidentiality, integrity, and availability - consistent with a sandbox escape. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update Google Chrome to 153.0.8010.36 or later via the stable channel (per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html), then fully restart the browser to apply the update since Chrome staging does not take effect until relaunch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, issue an urgent communication to all Chrome users informing them of the vulnerability and the availability of patched version 153.0.8010.36, and enable automatic updates if not already active. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today