EUVD-2026-50602
GHSA-2gvw-rh95-856r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted HTML page to victim
-
DeliveryExploit separate renderer process vulnerability
-
ExploitAchieve code execution in sandboxed renderer
-
ExecutionInject malicious script/HTML via DevTools implementation flaw
-
PersistExecute attacker code in privileged DevTools context
-
ImpactAccess elevated Chrome internal APIs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two distinct preconditions. First, the attacker must have already compromised the Chrome renderer process - meaning a prior, separate renderer RCE vulnerability must be exploited in the attack chain; this CVE cannot be triggered standalone by an unauthenticated network attacker. Second, the victim user must visit a crafted HTML page controlled by the attacker (UI:R), satisfying the delivery mechanism. Chrome must be running a version prior to 151.0.7922.72. There is no requirement for the attacker to be authenticated to the target system or for any non-default Chrome configuration. Exploitation is limited by the hard precondition of renderer compromise: defenders who maintain renderer-level patches and Chrome version currency substantially reduce exposure to this vulnerability. DevTools does not need to be open or explicitly launched by the user for this flaw to be exploitable via the injection pathway. |
| Impact | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) captures the scope change to a privileged context and the network delivery pathway but understates attack complexity: the description explicitly requires a prior renderer compromise, a significant precondition that elevates real-world attack complexity well beyond AC:L. This creates a notable signal conflict: the CVSS AC:L implies low complexity, but the attack description implies a two-stage exploit chain - an inconsistency defenders should flag. The EPSS score of 0.18% at the 8th percentile strongly corroborates low exploitation probability and supports treating this as a defense-in-depth issue rather than an immediate high-priority incident. The vulnerability is not listed in CISA KEV and no public exploit code has been identified. In practice, this CVE only becomes dangerous as part of a chained exploit alongside a separate renderer RCE or sandbox-escape vulnerability. Organizations running Chrome below 151.0.7922.72 should patch as part of routine update cadence, but emergency response is not warranted absent evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker who has already exploited a separate renderer process vulnerability in Chrome crafts a malicious HTML page that leverages the DevTools implementation flaw to inject attacker-controlled script into a privileged DevTools page when the victim visits the attacker-controlled site. The injected script executes within the elevated DevTools context, potentially accessing internal Chrome debugging APIs beyond the renderer sandbox's normal reach. No public proof-of-concept is known, meaning this scenario remains theoretical in the absence of a paired renderer exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Script and HTML injection into privileged DevTools pages in Google Chrome prior to 151.0.7922.72 is enabled when an attacker has already compromised the renderer process, exploiting an inappropriate implementation in DevTools (CWE-79). The vulnerability requires chaining with a prior renderer exploit: alone it cannot be triggered by a remote unauthenticated attacker without that precondition, making it a sandbox-escape amplifier rather than a standalone remote attack. EPSS is 0.18% (8th percentile), no public exploit has been identified, and it does not appear in CISA KEV, reflecting low observed exploitation pressure despite the Medium CVSS rating.
RemediationAI
The primary fix is to update Google Chrome to version 151.0.7922.72 or later, which is available via Chrome's built-in auto-update mechanism or the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. This patch resolves the inappropriate DevTools implementation that permitted script injection from a compromised renderer. Because exploitation requires an already-compromised renderer process, organizations that cannot immediately deploy the update should prioritize mitigating renderer-level vulnerabilities through Chrome's existing sandbox hardening features - enabling strict site isolation (--site-per-process, enabled by default in modern Chrome) and restricting DevTools access to trusted administrators only via enterprise policy (DevToolsAvailability GPO setting). Restricting DevTools access eliminates the privileged injection surface entirely, though it prevents legitimate developer use. No significant side effects are expected from the patch itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Google Chrome's DevTools interface runs in a privileged browsing context with elevated access to internal Chrome APIs and debugging capabilities. The underlying flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting): DevTools fails to properly sanitize or isolate content injected from the renderer process, allowing attacker-controlled scripts or HTML to execute within the privileged DevTools page. The renderer process in Chrome is normally sandboxed, but a prior renderer compromise - via a separate vulnerability - can be leveraged to supply crafted content that this DevTools implementation incorrectly trusts and renders. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome stable builds prior to 151.0.7922.72 across platforms. Chromium classified this as Medium severity, consistent with the scope-changing but limited-impact nature of privileged-page XSS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AC:H reflects the hard prerequisite of a compromised renderer process; all other metrics align with network delivery, scope change to DevTools, and limited XSS impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB