EUVD-2026-40510
GHSA-fm8g-chhx-hqqg
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:N/UI:R for web delivery, AC:H reflecting the required prior renderer compromise, PR:N as no browser account is needed, and S:C because escaping the renderer sandbox crosses a security boundary.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Privilege escalation in Google Chrome's Extensions subsystem before version 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of that context and gain elevated privileges by delivering a crafted HTML page. Google rates the Chromium severity as High, and the assigned CVSS is 7.5 (AV:N/AC:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is the explicit, concrete prerequisite stated in the CVE and the single most important limiting factor, meaning the flaw is a second-stage sandbox/privilege-escalation primitive that cannot be triggered from a clean browser state on its own. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are consistent and point to a real-but-not-urgent issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first lands a separate renderer-compromise bug - for example by luring a victim to a malicious site that exploits a JavaScript-engine flaw - then serves a crafted HTML page that abuses the insufficient extension policy enforcement to escalate out of the renderer sandbox into a higher-privileged Chrome context. The AC:H and UI:R metrics mean success depends on the victim visiting attacker content and on winning the harder conditions of the flaw; no public exploit is identified at time of analysis, so this remains a plausible chain component rather than a demonstrated turnkey attack. |
| Remediation | Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel, per Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; on managed fleets, verify auto-update is enabled and force a browser relaunch so the new binary loads, since Chrome only applies updates on restart. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Google Chrome versions below 150.0.7871.47. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today