EUVD-2026-50783
GHSA-9w9w-6mf2-jrc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate bug
-
DeliveryServe crafted HTML page
-
ExploitTrigger use-after-free in Navigation
-
ExecutionCorrupt browser-process memory
-
ImpactEscape sandbox to host privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is explicitly stated and is the hard gating prerequisite; the bug is a sandbox-escape stage, not an initial-access vector. Additional conditions from the CVSS vector: the victim must load attacker-controlled content (UI:R), and successful exploitation is high-complexity (AC:H), implying heap-layout grooming and non-deterministic conditions rather than a trivial trigger. Limiting factors: it only helps an attacker who already holds renderer code execution, it targets Chrome versions before 151.0.7922.72, and it does not by itself provide remote code execution against a fully patched or un-compromised browser. |
| Impact | Signals are mixed and should be read together. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) yields 8.3 and reflects a scope-changing, high-impact bug, but AC:H and UI:R already flag that exploitation is non-trivial and requires the victim to load malicious content. Critically, the description states the attacker must have ALREADY compromised the renderer process - so in practice this is a chained sandbox-escape, not a one-shot remote exploit, which tempers the PR:N rating (the raw vector does not capture the renderer-compromise prerequisite). EPSS is low (0.29%, 21st percentile), it is NOT on CISA KEV, and no POC is referenced, so there is no evidence of active or imminent widespread exploitation. Net: real and worth patching promptly because Chrome is ubiquitous and sandbox escapes are prized in exploit chains, but current data points to a high-severity-but-not-actively-exploited issue rather than an emergency. |
| Exploit ScenarioDerived | An attacker first compromises the Chrome renderer using a separate bug (or a chained primitive), then serves a crafted HTML page that drives Navigation into a use-after-free, corrupting browser-process state to escape the sandbox and gain higher-privileged code execution on the host. Realistically this is delivered via a malicious or compromised website that the victim visits (UI:R), and the high attack complexity (AC:H) means reliable exploitation requires precise heap grooming. No public POC is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's Navigation component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a renderer-level foothold toward host-level code execution. Chromium rates the security severity High and the CVSS is 8.3; no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile). This is the second-stage bug in a typical Chrome exploit chain rather than a standalone remote-code-execution primitive.
RemediationAI
Vendor-released patch: Google Chrome 151.0.7922.72 (or later) on the Stable channel - update Chrome and relaunch so the new version takes effect, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update via your enterprise policy/MDM and verify version compliance rather than relying on user-initiated updates. Users of other Chromium-based browsers should install the vendor build that incorporates the equivalent Chromium fix. No standalone configuration workaround exists for a memory-corruption bug in Navigation; as interim compensating controls, ensure the built-in sandbox is not disabled (never run with --no-sandbox), enable site isolation, and reduce exposure to untrusted pages, accepting that these reduce but do not eliminate risk until the update is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chromium's Navigation subsystem, the machinery that handles page loads, session history, frame lifecycle, and document commits across the browser and renderer processes. Use-after-free bugs occur when a pointer to a freed object is subsequently dereferenced, allowing an attacker who controls heap allocation to place attacker-chosen data where the freed object used to be and thereby corrupt control flow or object state. Because Navigation logic straddles the privileged browser process and the sandboxed renderer, a UAF here is especially valuable for crossing the sandbox boundary. The affected product per CPE is cpe:2.3:a:google:chrome:*, i.e. the Google Chrome desktop browser built on Chromium.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Attacker must already control the renderer (PR:L) and groom the heap (AC:H) while the victim loads malicious content (UI:R); sandbox escape crosses a trust boundary (S:C) with full host impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome users running versions prior to 151.0.7922.72 face a high-severity sandbox escape vulnerability (CVSS 8.3) capable of enabling system-level code execution if exploited as part of a multi-stage attack. Although current exploitation probability is low (0.3% per industry metrics) and no public exploit is known, a patch is immediately available and should be deployed across all Chrome installations. Immediate patching is the appropriate mitigation for this risk vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB