EUVD-2026-50776
GHSA-hcvj-frqw-68mv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer process (prior exploit)
-
DeliveryServe crafted HTML page to victim
-
ExploitTrigger use-after-free in Compositing
-
ExecutionCorrupt browser-process memory across sandbox
-
ImpactEscape sandbox, execute code in browser process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process (a prior renderer-code-execution primitive is a hard prerequisite stated in the description) and then delivers a crafted HTML page that is rendered by the victim, so user interaction (navigating to/loading the malicious content) is required. Limiting factors: the bug is a sandbox-escape second stage - it cannot be triggered without the pre-existing renderer compromise; CVSS marks AC:H (non-trivial heap grooming/timing to win the use-after-free) and UI:R; and only Chrome/Chromium builds prior to 151.0.7922.72 are vulnerable. It affects default Chrome configurations (no special feature toggle needed) but only in the context of an existing renderer foothold. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, 8.3 High) reflects network reach, high attack complexity, required user interaction (visiting a page), and a scope change into a total-impact sandbox escape - which aligns with CISA SSVC's 'Technical Impact: total'. However, multiple lower-risk signals converge: SSVC lists Exploitation as none, Automatable as no, EPSS is only 0.31% (23rd percentile), it is not in CISA KEV, and no public POC is identified. Critically, this is a chained bug - the description explicitly requires a pre-compromised renderer, so PR:N in the official vector understates the real precondition (the attacker must first land a renderer RCE). Net: patch-worthy and genuinely 'Critical' in Chrome's severity model because a total sandbox escape is the payoff, but not an imminent mass-exploitation threat as a standalone issue. Prioritize via normal Chrome auto-update cadence rather than emergency out-of-band response absent new exploitation evidence. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer vulnerability to run code inside Chrome's sandboxed renderer, then serves or navigates the victim to a crafted HTML page that triggers the use-after-free in the Compositing code to corrupt memory across the sandbox boundary and execute code in the higher-privileged browser process. No public POC is identified at time of analysis, and the high attack complexity plus required user interaction make this a second-stage component of a chained exploit rather than a one-shot drive-by. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's Compositing component (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain broader code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3 (scope-changing use-after-free, CWE-416), it is a second-stage bug that presumes an existing renderer compromise rather than a standalone entry point. There is no public exploit identified at time of analysis and EPSS is low (0.31%, 23rd percentile), consistent with CISA SSVC marking exploitation as none.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms (Chrome's built-in updater delivers this automatically; force it via chrome://settings/help and relaunch to apply). Enterprises should confirm managed update policies are not pinning Chrome to an older milestone and expedite ring rollout given the Critical severity. Users of Chromium-based browsers should apply their vendor's build that incorporates the equivalent fix. There is no configuration-only workaround for the compositor code itself; as a compensating control, enabling site isolation (default) and avoiding disabling the sandbox (never run with --no-sandbox) preserves the very boundary this bug attacks, and restricting users to trusted sites reduces exposure to the crafted-page delivery - though neither substitutes for patching. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and https://issues.chromium.org/issues/514442821.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Compositing subsystem, the part of Blink/the browser process responsible for turning rendered layers into the final on-screen image (the compositor manages layer trees, GPU surfaces, and frame lifecycle). A use-after-free arises when compositor code retains and dereferences a pointer to an object whose backing memory has already been freed, allowing an attacker who controls heap layout to reclaim that memory and steer execution. Because Chrome isolates web content in a low-privilege renderer sandbox, a bug reachable across the renderer/browser boundary (as here) enables a sandbox escape into the more privileged browser process. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome desktop application; the same fix ships to all Chromium-based browsers that pull the upstream release.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered crafted page with UI:R and high-complexity heap exploitation; the required prior renderer compromise is modeled as an attack condition (AC:H) rather than PR, and the sandbox escape yields S:C with total C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a sandbox escape vulnerability that allows attackers to break out of the browser and gain system-level code execution. For organizations deploying Chrome widely, successful exploitation could enable attackers to move laterally across networks and access sensitive data. Immediate patching is required; the vendor has released fixes and deployment should be prioritized.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB