EUVD-2026-23064
GHSA-vhh6-f54w-x5gw
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Renderer pre-compromise raises AC:H; no OS-level auth needed so PR:N; scope changes from renderer to host so S:C with full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome on Windows (prior to 147.0.7727.101) exploits an uninitialized variable in the Accessibility subsystem to break out of the renderer sandbox. Exploitation requires an attacker who has already compromised the renderer process and can deliver a crafted HTML page to the victim, making this a second-stage payload in a chained attack. No public exploit has been identified and EPSS sits at 0.02% (6th percentile), consistent with SSVC's Exploitation:none verdict; however, the CVSS S:C scope-change and total C/I/A impact reflect the severity if the full chain fires.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) manifests in Chrome's Accessibility component on Windows, which bridges the renderer's DOM with Windows accessibility APIs such as IAccessible/UI Automation. Uninitialized memory in this bridge can hold attacker-influenced values when the renderer is under adversary control, providing a primitive to escape Chrome's sandbox - the OS-level process isolation that confines renderer content. The affected product is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on Windows only; the bug is not present on other platforms per the description. The CVSS S:C (scope change) metric confirms the impact crosses the renderer process boundary into the broader browser process or OS context.
RemediationAI
Vendor-released patch: Chrome 147.0.7727.101 for Windows. Chrome auto-updates by default, so most users will receive the fix without manual intervention; verify the installed version via chrome://settings/help. Enterprise environments using extended stable or managed deployments should push the update through their software management tooling as soon as testing permits. No documented workarounds exist for this specific flaw; the only effective mitigation is applying the update. Disabling accessibility features would not be a reliable workaround and would degrade usability for users who depend on them. Reference: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html.
Same weakness CWE-457 – Use of Uninitialized Variable
View allVendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today