Google Chrome EUVD-2026-50685

Exploitation requires two distinct preconditions that must both be satisfied. First, the attacker must have already achieved code execution within Chrome's renderer process prior to leveraging this flaw-this vulnerability is not a standalone entry point but the second link in an exploit chain, and a separate renderer RCE vulnerability or compromise method must precede it. Second, user interaction is required (CVSS UI:R), consistent with the target user visiting a malicious or attacker-controlled webpage that initiates the BFCache-triggering navigation sequence. The sandbox escape specifically occurs through BFCache's handling of serialized page state during back/forward cache restore operations. Key limiting factors: (1) the mandatory prior renderer compromise raises the technical bar significantly beyond a typical one-click browser vulnerability; (2) SSVC confirms the attack is not automatable, ruling out worm-style mass exploitation; (3) the flaw is fully absent in Chrome 151.0.7922.72 and later. No special server-side configuration or non-default Chrome settings are required once the renderer is compromised.

The CVSS base score of 8.7 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N demands careful decomposition. PR:L reflects the prerequisite of an already-compromised renderer process, meaning this is the second stage of a chained exploit rather than a standalone vulnerability-a fact that substantially narrows the realistic attacker population. Scope:Changed (S:C) confirms the sandbox escape genuinely crosses isolation boundaries into the browser process, validating the high impact ratings. UI:R indicates the user must visit a malicious page, ruling out fully passive exploitation. Against these severity signals, SSVC rates exploitation as 'none' and automatable as 'no,' while EPSS at 0.21% (11th percentile) places real-world exploitation probability well below average. The VulDB 'Information Disclosure' tag is inconsistent with the actual C:H/I:H sandbox escape impact and should not be used for classification purposes-treat it as incomplete third-party metadata. The net assessment is a technically serious vulnerability best prioritized in environments with elevated threat profiles (e.g., high-value targets, browser-forward enterprise environments), while patch deployment remains the correct action for all users regardless of threat level.

A sophisticated attacker first compromises a Chrome renderer process using a separate renderer-level vulnerability-likely delivered via a malicious web page that the target user visits. With renderer-level code execution established, the attacker navigates the compromised renderer to a crafted HTML page engineered to trigger Chrome's BFCache restoration path, supplying malicious cached state that bypasses the BFCache input validation and allows the renderer to interact with the browser process in ways that escape the sandbox. No public proof-of-concept has been identified at time of analysis, and the chained nature of the attack limits realistic exploitation to technically advanced, targeted threat actors.