EUVD-2026-74402
GHSA-6x82-ghmg-h6pg
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects mandatory two-stage chain (renderer compromise first); S:C captures sandbox escape; UI:R required for social engineering step.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
7DescriptionCVE.org
Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape via incorrect authorization in the Views component of Google Chrome on Windows (versions prior to 153.0.8010.36) enables arbitrary code execution outside the browser sandbox. Exploitation requires an attacker to first compromise the renderer process and then leverage social engineering to induce user interaction with a crafted HTML page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two prerequisites must both be satisfied: (1) the attacker must have already compromised the Chrome renderer process on Windows - this is a significant prerequisite that itself requires a separate exploit or vulnerability; (2) the attacker must leverage social engineering to induce the victim to interact with a crafted HTML page (UI:R in CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world exploitation risk is moderate-to-low despite the High CVSS score of 8.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Chrome 153.0.8010.36 for Windows. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit Chrome deployment across Windows infrastructure to identify current version footprint and any systems running versions prior to 153.0.8010.36. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today