EUVD-2026-34496
GHSA-xfq2-ggp9-9j86
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Inappropriate implementation in Base in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw resides in the Base component and is rated Medium severity by Chromium despite the CVSS 9.6 score, reflecting the prerequisite of a prior renderer compromise. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify Windows systems running Chrome and verify whether auto-update is enabled or if manual patch deployment is required. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all Windows environments; confirm auto-update settings are active for consumer devices and enforce deployment via device management for enterprise systems. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing t
Privilege elevation in Microsoft Azure HorizonDB allows remote unauthenticated attackers to bypass authentication via id
Local privilege escalation in Google Android XR stems from a missing permission check in InputMethodManagerService.addIn
Arbitrary file read and remote code execution in Vitest versions prior to 4.1.0 allow remote unauthenticated attackers t
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows a remote attacker to trigge
Share
External POC / Exploit Code
Leaving vuln.today