EUVD-2026-50673
GHSA-7xmf-5qm5-jq3w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryCompromise sandboxed renderer via separate bug
-
ExploitTrigger DNS use-after-free in browser process
-
ExecutionReallocate freed memory with controlled data
-
ImpactEscape sandbox to browser-process privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised Chrome's sandboxed renderer process - this is explicitly a sandbox-escape second stage, not an initial-access flaw. It further requires user interaction (UI:R): the victim must load a crafted HTML page under attacker influence, and the victim must be running Chrome prior to 151.0.7922.72. Limiting factors: the mandatory pre-existing renderer compromise means a full exploit chain (typically a separate renderer RCE) is needed; SSVC marks exploitation as none and non-automatable; and Chromium itself rated the severity Low. These conditions substantially narrow realistic exploitation despite the 9.6 base score. |
| Impact | Signals here conflict and must be weighed carefully. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) reflects the total technical impact of a full sandbox escape with scope change, and SSVC likewise rates Technical Impact as total. However, the CVSS PR:N understates a critical prerequisite stated plainly in the description: the attacker must have ALREADY compromised the renderer process, so this is inherently a second-stage bug in an exploit chain, not a standalone remote-compromise primitive. That reality is reflected in the lower-risk signals: Chromium's own severity rating is Low, SSVC Exploitation is 'none', Automatable is 'no', EPSS is 0.17% (7th percentile), and there is no KEV listing or public PoC. Net assessment: patch on the normal Chrome update cadence, but this is not an emergency 'high-CVSS, high-real-risk' item on its own - its danger is realized only when combined with a separate renderer RCE. |
| Exploit ScenarioDerived | An attacker first lures a user to a malicious web page and exploits a separate renderer vulnerability to gain code execution inside Chrome's sandboxed renderer. From that foothold they serve crafted HTML/DNS interactions that trigger the use-after-free in the browser process's DNS handling, corrupting memory to escape the sandbox and run code at browser-process privilege. No public exploit is identified at time of analysis, so this remains a theoretical chain absent a paired renderer bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome desktop before 151.0.7922.72 lets an attacker who already controls a compromised renderer process break out of the sandbox by triggering a use-after-free in the browser's DNS handling via a crafted HTML page. Chromium rated the issue Low severity, and while the NVD CVSS is 9.6, SSVC records no observed exploitation and it is not automatable; there is no public exploit identified at time of analysis and it is not in CISA KEV. EPSS is low at 0.17% (7th percentile), consistent with a second-stage chaining bug rather than a mass-exploited entry point.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later (Stable channel), per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html; relaunch the browser to apply the update since Chrome patches only take effect after restart. In managed environments, push the update via your enterprise update policy and confirm forced relaunch to close the window on unpatched sessions. No standalone workaround fully removes the DNS use-after-free, but because exploitation requires a prior renderer compromise, keeping the site-isolation sandbox enabled (default), restricting untrusted browsing, and ensuring any renderer-level RCEs are also patched materially reduce the chance this bug is reachable; the trade-off of these controls is only reduced attack surface, not a substitute for the update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's DNS subsystem, which resolves hostnames on behalf of the browser process. A use-after-free occurs when memory is freed but a dangling pointer is later dereferenced, allowing an attacker to reallocate that memory with controlled data and corrupt program state. Because DNS resolution logic runs in the privileged browser process rather than the sandboxed renderer, corrupting it from a compromised renderer provides a path across Chrome's renderer/browser trust boundary - the essence of a sandbox escape. The affected component is Google Chrome (cpe:2.3:a:google:chrome:*), the Chromium-based desktop browser, on the Stable channel prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable via crafted page with UI:R, but AC:H because it demands a pre-compromised renderer and precise heap grooming; scope changes (S:C) on sandbox escape with total C/I/A impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop versions before 151.0.7922.72 contain a critical-severity sandbox escape (CVE-2026-17924) that could allow attackers with existing renderer process compromise to escalate to system-level access. A vendor patch is available. While no active exploitation or public exploit code has been observed, this represents a high-risk step in advanced attack chains and should be prioritized for timely deployment across your organization's Chrome installations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB