EUVD-2026-50645
GHSA-fgwx-rxh3-crgv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure victim to open page in vulnerable Chrome
-
ExploitTrigger use-after-free in DevTools
-
ExecutionReuse dangling pointer to corrupt memory
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled crafted HTML in a vulnerable Chrome build (<151.0.7922.72) and to trigger the DevTools use-after-free, so the DevTools code path must be exercised during the victim's session. Limiting factors: high attack complexity (AC:H) reflecting the timing/heap-grooming needed for a reliable UAF, mandatory user interaction (UI:R) to open the malicious page, and unchanged scope with execution confined to the renderer sandbox - a further sandbox-escape would be needed for host-level impact. No authentication is required (PR:N). |
| Impact | Signals are mixed and point to lower real-world urgency than the 7.5 base score suggests. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U) requires network delivery but also high attack complexity (a memory-corruption race typical of UAF) and user interaction (visiting a malicious page), while scope is unchanged. Chromium's own triage rated this Medium, and the impact is contained to the sandbox - the C:H/I:H/A:H rating reflects impact within the renderer, not the host, so raw CVSS likely overstates practical severity. EPSS is low (0.27%, 19th percentile), there is no CISA KEV listing and no public exploit identified, and no SSVC decision data was provided. Net: a genuine memory-safety bug worth patching in the normal cycle, but not an emergency absent a chained sandbox-escape. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures a victim into visiting it; interaction with the page triggers the use-after-free in DevTools, corrupting memory to execute attacker-controlled code inside the Chrome renderer sandbox. Achieving reliable exploitation is non-trivial (high complexity, requires user interaction), and the payload would need to be chained with a separate sandbox-escape to affect the host. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandboxed remote code execution in Google Chrome's DevTools component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated Medium by Chromium; no public exploit has been identified and EPSS estimates only a 0.27% exploitation probability, indicating low near-term likelihood despite the high CVSS base score. Critically, code execution is confined to the sandbox and does not by itself constitute a full host compromise.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome normally auto-updates, so ensure the browser is fully closed and relaunched to apply the update and confirm the version under chrome://settings/help. In managed fleets, push the updated build through your enterprise update policy. As an interim compensating measure while updates roll out, restrict use of DevTools on untrusted pages and avoid opening developer tooling on unknown sites; note that fully disabling DevTools via the DeveloperToolsAvailability enterprise policy reduces exposure to this DevTools-specific bug but breaks legitimate developer workflows, so scope it to non-developer user groups.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome DevTools, the built-in developer/debugging surface of the Chromium engine that powers Google Chrome (CPE cpe:2.3:a:google:chrome). The root cause is CWE-416 (Use After Free): an object in DevTools is freed while a reference to it remains live, and a crafted page can then cause that dangling pointer to be reused, corrupting memory and steering control flow. Because Chromium isolates renderer/DevTools processes, the resulting code execution occurs inside the browser sandbox rather than at OS privilege - the description explicitly states 'execute arbitrary code inside a sandbox,' meaning this is not a standalone sandbox escape.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page with no auth (PR:N) but a UAF race needing UI:R and AC:H; scope unchanged as code runs in the renderer sandbox, with high renderer C/I/A impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability in DevTools that allows attackers to execute arbitrary code within the browser sandbox when users visit a crafted webpage. While this affects a critical tool used across most organizations, technical analysis indicates low near-term exploitation probability (0.3% EPSS), and code execution remains confined to the browser sandbox rather than providing full system access.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB