EUVD-2026-50657
GHSA-xqxh-qgrp-wxhr
Severity by source
Sources disagree (Low–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
AC:H reflects the mandatory renderer pre-compromise; S:C captures the sandbox boundary crossing; C/I/A:L reflect limited post-escape impact consistent with Chromium's own Low severity rating.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.
Technical ContextAI
Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) runs renderer processes inside an OS-level sandbox to contain damage from memory-corruption or logic bugs in web content processing. The Printing subsystem on Windows serves as a bridge between the sandboxed renderer and the host OS - it receives data from the renderer to construct print jobs. CWE-20 (Improper Input Validation) indicates that the Printing component failed to adequately validate renderer-supplied input before acting on it in a more privileged context, creating a pathway to escape the sandbox boundary. The vulnerability is Windows-specific, implying a reliance on Windows printing APIs or IPC mechanisms not present on other platforms.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 for Windows. Upgrade to this version or later via Chrome's built-in update mechanism or enterprise deployment tooling; details are published in the stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation requires a prior renderer compromise, organizations with limited immediate patching capacity may reduce risk by enforcing Chrome's Site Isolation policy (already enabled by default in modern Chrome), which limits the blast radius of renderer compromise and reduces the likelihood of reaching the Printing attack surface. No trade-off exists to patching; the update is a routine stable-channel release. Restricting access to the Windows Print Spooler service for browser processes is a non-standard compensating control that may interfere with legitimate printing functionality and is not recommended as a long-term substitute for patching.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today