EUVD-2026-50671
GHSA-prc5-pgx6-37j6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure victim via phishing link
-
ExploitVictim opens page in vulnerable Chrome
-
ExecutionTrigger code injection in Enterprise component
-
ImpactExecute arbitrary code in browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or navigate to an attacker-crafted HTML page in a vulnerable Chrome build (prior to 151.0.7922.72) - this user interaction (CVSS UI:R) is the primary limiting factor. No authentication or pre-existing privileges are needed on the target (PR:N), and the attack is network-delivered with low complexity (AV:N/AC:L). The flaw resides in Chrome's Enterprise functionality, so exploitability may be tied to that code path being active; combined with Google's 'Low' Chromium severity rating and SSVC 'Automatable: no,' realistic exploitation is unlikely to be drive-by or wormable and would depend on targeted social engineering. No special server-side configuration is required on the victim beyond running an unpatched desktop Chrome. |
| Impact | The signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) frames this as a network-reachable, low-complexity, unauthenticated flaw with total confidentiality/integrity/availability impact, tempered only by required user interaction. Against that, several signals point to lower real-world urgency: EPSS is just 0.26% (17th percentile), CISA SSVC records Exploitation as 'none' and Automatable as 'no' (though Technical Impact is 'total'), there is no KEV listing, and no public exploit was identified. Most tellingly, Google's own Chromium severity rating is 'Low,' conflicting with the NVD 8.8 CVSS. This conflict should be stated explicitly: the CVSS-derived 'High' impression is not corroborated by vendor severity, exploitation telemetry, or automatability, so this is better treated as a routine browser-patch item than an emergency, while still being remediated on the normal Chrome auto-update cadence. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a Chrome user to it via a phishing link, malicious ad, or compromised website. When the victim's unpatched Chrome (before 151.0.7922.72) renders the page, the code-injection flaw is triggered and attacker-controlled code executes in the browser context. No public exploit code has been identified, and the attack hinges on the user actually visiting the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 allows a remote attacker to run arbitrary code within the browser by luring a victim to a crafted HTML page. The flaw stems from an inappropriate implementation in the Enterprise component and is classed as CWE-94 code injection. No public exploit identified at time of analysis, exploitation requires user interaction (visiting a malicious page), and EPSS risk is low at 0.26% (17th percentile).
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 - upgrade all desktop Chrome installations to 151.0.7922.72 or later on Windows, macOS, and Linux. Most endpoints receive this automatically via Chrome's built-in updater; verify by opening chrome://settings/help, confirming the running version, then relaunch to apply, since the fix is not active until the browser restarts. In managed/enterprise fleets, push the update through management tooling (Google Admin console, SCCM/Intune, or package managers) and set the RelaunchNotification policy so users actually restart. The authoritative advisory is the Chrome Releases stable-channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). As an interim compensating control until updates land, restrict browsing to trusted sites via enterprise policy or web filtering, since exploitation depends on the user loading a malicious HTML page; the trade-off is reduced usability and it is no substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Google Chrome's Enterprise-related functionality within the Chromium codebase. CWE-94 (Improper Control of Generation of Code / Code Injection) indicates that attacker-influenced input is treated as executable code rather than inert data, allowing the browser to be coerced into executing attacker-supplied instructions. The affected surface is the desktop Stable channel (cpe:2.3:a:google:chrome:*), which shares its rendering and JavaScript engine (Blink/V8) and policy-handling code across Windows, macOS, and Linux. Notably, Google's Chromium security team rated the underlying bug 'Low' severity, which diverges sharply from the NVD CVSS 8.8 rating and suggests the practical exploit primitive may be more constrained than a raw RCE label implies.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via a crafted page with no privileges but requiring the user to visit it (UI:R); code execution yields high C/I/A within the unchanged browser scope.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability that could allow attackers to compromise employee systems through malicious web pages, requiring only user interaction to trigger. While no active exploitation has been observed and exploit likelihood remains low (0.3% EPSS), the high CVSS score (8.8) and ubiquity of Chrome across organizational infrastructure make this a material risk to system integrity and data security.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB