EUVD-2026-40656
GHSA-vw9m-cqmx-vwfc
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered malicious file (AV:N) but requires victim DevTools gestures and non-trivial conditions (UI:R, AC:H); no privileges (PR:N); code execution yields high C/I/A but stays within the renderer sandbox (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: Medium)
AnalysisAI
Arbitrary code execution in Google Chrome's DevTools component (versions prior to 150.0.7871.47) lets a remote attacker run code inside the renderer sandbox after luring a victim into performing specific UI gestures with a malicious file. Rated Medium by Chromium but scored CVSS 7.5, the flaw stems from insufficient validation of untrusted input (CWE-20); no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.24% (15th percentile).
Technical ContextAI
The affected component is Chrome DevTools, the built-in debugging and inspection suite bundled with the Chromium/Blink browser engine. The root cause is CWE-20 (Improper Input Validation): DevTools accepts untrusted input - here delivered via a malicious file the user is coaxed into opening/loading through DevTools workflows - without adequately sanitizing it before use, enabling code execution within Chrome's sandboxed renderer process. Because execution is contained 'inside a sandbox,' the attacker gains code execution in the constrained renderer context rather than the host OS, which typically requires chaining a separate sandbox-escape bug for full system compromise. The single upstream tracking issue (chromium issues.chromium.org/issues/513762145) is access-restricted per Google's standard embargo for browser security bugs.
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable Channel Update for Desktop advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); Chrome auto-updates, so ensuring the browser is fully closed and relaunched applies the fix, and enterprises should push the build through their management channel. There is no vendor-published standalone workaround, but because exploitation requires the victim to open a malicious file and perform specific DevTools UI gestures, effective compensating controls until patching include instructing users not to load untrusted files into DevTools and, in managed environments, restricting or disabling DevTools via the DeveloperToolsAvailability enterprise policy (trade-off: this hampers legitimate web-developer and support workflows). Users of Chromium-based browsers should apply their vendor's update once it rebases onto the patched Chromium.
Same weakness CWE-20 – Improper Input Validation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today