EUVD-2026-50694
GHSA-9j67-5g46-g34m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryChrome renderer loads malicious File Input content
-
ExploitTrigger inappropriate File Input implementation
-
ExecutionEscape renderer sandbox (scope change)
-
ImpactGain privileges beyond sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-controlled crafted HTML page in Google Chrome on Linux at a version below 151.0.7922.72 - per CVSS UI:R, user interaction (navigating to or loading the malicious page) is mandatory, so this is not a zero-click attack. The specific product feature required is Chrome's File Input handling on the Linux desktop build; the description explicitly scopes the flaw to Linux, so other platforms are not confirmed affected from this data. The scope change (S:C) reflects that a successful trigger crosses the renderer sandbox boundary. Limiting factors: mandatory user interaction, Linux-platform specificity, vulnerable version below the patched 151.0.7922.72, and Medium-rated Low impacts rather than full system compromise. |
| Impact | Signals are mixed and point to real-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows a network-reachable, low-complexity, unauthenticated attack, and the scope change (S:C) reflects the sandbox boundary being crossed - the most security-relevant aspect - but all three impacts are only Low, consistent with Chromium's own Medium severity rating rather than a full critical RCE. EPSS is low (0.21%, 11th percentile) and there is no CISA KEV listing and no public exploit identified, so widespread or active exploitation is not indicated. The UI:R requirement (a user must open a crafted page) is a meaningful limiter. Note a nuance: a File Input picker typically implies some user interaction, which is consistent with UI:R; the vector is internally coherent. Overall this is a patch-in-normal-cadence issue for most environments, elevated only where Chrome on Linux is a high-value target. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a Linux Chrome user to open it (via phishing link, malvertising, or a compromised site). When the page is rendered, the File Input implementation flaw is triggered to escape the renderer sandbox and gain elevated privileges outside the confined process. No public proof-of-concept has been identified, and the network-reachable, low-complexity vector is offset by the required user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome on Linux before 151.0.7922.72 lets a remote attacker break out of the renderer sandbox when a victim opens a crafted HTML page, abusing an inappropriate implementation in the File Input component (CWE-269, improper privilege management). Rated Medium by Chromium and scored CVSS 7.1 with a scope change, it requires user interaction (visiting a malicious page) but no authentication; there is no public exploit identified and EPSS exploitation probability is low at 0.21% (11th percentile).
RemediationAI
Update Google Chrome on Linux to version 151.0.7922.72 or later, which contains the vendor fix (Vendor-released patch: 151.0.7922.72) as announced in the Chrome stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser after updating so the new build loads, since Chrome applies updates only on relaunch. In managed fleets, push the update via your enterprise update policy or package manager and verify the running version reflects 151.0.7922.72+. As an interim compensating control before patching, limit exposure by restricting untrusted browsing (enforce SafeSites/URL allowlisting or route traffic through a web filter to reduce the chance of loading attacker-crafted pages), accepting the trade-off of reduced browsing flexibility; because exploitation hinges on rendering a malicious page, this lowers but does not eliminate risk. No effective per-feature toggle for File Input is documented, so patching is the definitive remedy.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's File Input handling, the browser subsystem that mediates <input type="file"> file-picker interactions between untrusted web content and the local system. Chrome's multi-process security model confines web page rendering inside a sandboxed renderer process; a 'sandbox escape' means untrusted page-controlled code can cross that trust boundary and gain the privileges of a higher-privileged process. The root cause is classified as CWE-269 (Improper Privilege Management), indicating the File Input implementation did not correctly enforce the privilege separation the sandbox is designed to guarantee. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, specifically the Linux desktop build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Remote crafted page needs no auth (PR:N) but requires the user to open it (UI:R); sandbox escape crosses a trust boundary (S:C) with Medium-rated Low impacts.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on Linux versions before 151.0.7922.72 contains a sandbox escape vulnerability in the File Input component that allows code execution at elevated privilege levels when users visit a malicious webpage; no public exploit has been identified at time of analysis. This exposes all Linux-based workstations and systems running Chrome to potential unauthorized access and compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in Google Chrome Multiple Security Flaws
View all 80Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB