EUVD-2026-74506
GHSA-6g4w-r5fc-vqc3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs user to load it (UI:R, PR:N); a sandbox escape crosses trust boundaries (S:C) with full code-execution impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution in Google Chrome's ANGLE graphics component on Windows (versions prior to 153.0.8010.36) allows a remote attacker to trigger an out-of-bounds write and potentially execute arbitrary code outside the browser sandbox via a crafted HTML page. Rated Chromium 'High' with a CVSS of 9.6 reflecting a scope-changing sandbox escape, though exploitation requires the victim to load malicious web content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim to open a crafted HTML page in Google Chrome on Windows prior to 153.0.8010.36 (UI:R - user interaction is mandatory; no prior authentication is needed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update Google Chrome to 153.0.8010.36 or later on Windows via the Chrome stable channel; restart the browser to apply the update since Chrome patches only take effect after relaunch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all Windows systems running Google Chrome prior to version 153.0.8010.36 and classify by risk tier based on user role and data access; prioritize tier-1 assets including executive workstations and development machines. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today