EUVD-2026-74311
GHSA-vfp7-2x6m-rmp3
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects mandatory renderer pre-compromise; S:C captures sandbox escape to host process; full C/I/A impact outside sandbox is warranted.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape via improper input validation in Chrome's SiteIsolation component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox. Affected versions are all Chrome releases prior to 153.0.8010.36. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two distinct preconditions: (1) the victim must visit a crafted HTML page that first compromises the Chrome renderer process via a separate vulnerability - this is an explicit prerequisite stated in the CVE description ('remote attacker who had compromised the renderer process'); (2) user interaction is required (UI:R) since the victim must navigate to the attacker-controlled page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.3 (High) score reflects the severity of full sandbox escape with scope change (S:C, C:H/I:H/A:H), but AC:H appropriately captures that this is a second-stage vulnerability requiring a pre-compromised renderer. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome to version 153.0.8010.36 or later, which is confirmed available per the vendor's stable-channel release advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and catalog all Chrome deployments across the organization, noting versions prior to 153.0.8010.36. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today