EUVD-2026-50695
GHSA-vmr6-58p5-pq47
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Renderer pre-compromise encoded as AC:H; S:C reflects sandbox boundary crossing; C/I/A:L scoped to the OOB read's direct contribution, not full chain impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.
Technical ContextAI
Skia is Google's open-source 2D graphics engine embedded in Chrome for all rendering operations - it processes path data, image decoding, and GPU-accelerated drawing. CWE-125 (Out-of-Bounds Read) identifies the root cause as a memory safety flaw where Skia reads beyond the intended buffer boundary when processing attacker-controlled graphics or HTML content. This class of bug can expose adjacent heap or stack memory and, in a sandbox-escape context, may be used to leak pointer values or corrupt data structures that underpin sandbox isolation mechanisms. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome variants prior to the fixed build 151.0.7922.72. The CVSS S:C (Changed Scope) metric confirms that successful exploitation crosses the renderer process sandbox boundary into the host OS context - the defining characteristic of a sandbox escape.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later immediately via the Chrome stable channel; this is the vendor-confirmed fix per the release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise administrators should enforce Chrome updates via Google Admin Console or policy management to ensure fleet-wide coverage. For environments with delayed patch cycles, browser isolation (running Chrome in a VM or container) reduces post-sandbox-escape blast radius by confining the attacker's foothold to the isolated environment rather than the host OS. Disabling JavaScript or using a script-blocking extension would substantially limit exposure to HTML-delivered exploit payloads but introduces significant usability trade-offs. These compensating controls do not substitute for patching given the ubiquitous deployment of Chrome.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today