EUVD-2026-50796
GHSA-qfg6-74c9-5pcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise sandboxed renderer process
-
DeliveryServe crafted HTML page
-
ExploitTrigger use-after-free in Views
-
ExecutionReclaim freed object, hijack execution
-
ImpactEscape sandbox into browser process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the sandboxed renderer process (an explicit prerequisite in the CVE description) and can then drive a crafted HTML page to trigger the Views use-after-free; per CVSS UI:R, victim interaction such as loading the malicious page is also required. This is therefore a second-stage sandbox-escape primitive, not a standalone remote-unauthenticated exploit - the renderer-compromise dependency is the primary limiting factor, and the affected build is Chrome desktop prior to 151.0.7922.72. SSVC marks exploitation as none and non-automatable, and no public exploit is identified at time of analysis, further limiting realistic risk. |
| Impact | Signals are mixed and must be read together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) looks critical, but the base metrics understate a crucial precondition stated in the description: the attacker must ALREADY have compromised the renderer process, which is not reflected as privilege or complexity in Google's scoring. SSVC corroborates a lower operational urgency - Exploitation: none, Automatable: no - while rating Technical Impact as total (a genuine sandbox escape). EPSS is low (0.29%), and there is no KEV listing and no public exploit identified at time of analysis. Net assessment: this is a real and serious bug (full sandbox escape) but a chained, second-stage one - not a standalone remote drive-by - so it is a standard-priority browser patch rather than an emergency. The apparent conflict between the 9.6 network-unauthenticated score and the description's 'compromised renderer' prerequisite should be noted: the high score assumes the renderer is already attacker-controlled. |
| Exploit ScenarioDerived | An attacker first gains code execution inside Chrome's sandboxed renderer (for example by chaining a separate renderer RCE bug), then lures or drives the victim to a crafted HTML page that triggers the use-after-free in the Views browser-process code. By grooming the heap and reclaiming the freed object, the attacker escalates out of the sandbox into the more-privileged browser process. No public exploit is identified at time of analysis, and UI:R indicates some user interaction (loading the malicious page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and total confidentiality/integrity/availability impact, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with a second-stage bug that requires prior renderer compromise rather than a directly weaponizable entry point.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable desktop channel, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); most installations auto-update, so verify via chrome://settings/help and relaunch to apply. There is no supported in-product workaround for a memory-corruption bug, but because exploitation requires a compromised renderer as the first stage, defenders can reduce the entry-surface by keeping site isolation enabled (default), deploying enterprise policies to enforce timely updates, and restricting untrusted-site browsing; these lower the odds of the renderer compromise that precedes this escape but do not remediate the underlying UAF. Downstream Chromium-based browsers should be updated to the build that incorporates the equivalent Chromium fix (Chromium issue 513228974).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Views framework - the C++ UI toolkit that renders and manages browser window widgets, menus, and controls in the privileged browser process. Use-after-free arises when an object is freed but a dangling pointer is later dereferenced, allowing an attacker who controls heap layout to reclaim the freed memory and steer execution or corrupt state. Because Views executes in the higher-privileged browser process rather than the sandboxed renderer, a UAF here is a classic sandbox-escape primitive: a compromised renderer sends crafted IPC/UI interactions that trigger the dangling reference in the browser process. The affected CPE is cpe:2.3:a:google:chrome (all versions up to the fix), and the tag set (Use After Free, Memory Corruption, Denial Of Service) reflects both control-flow-hijack and crash outcomes typical of this bug class.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Full sandbox escape gives scope change and total C/I/A, but the description's required prior renderer compromise plus heap grooming justifies AC:H rather than AC:L.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome (desktop) versions prior to 151.0.7922.72 contain a use-after-free vulnerability in the Views UI framework allowing remote attackers to escape the browser sandbox if the renderer process has already been compromised, resulting in full system access. While not currently under active exploitation, this vulnerability poses critical risk to organizations whose Chrome users may be targeted by multi-stage attacks combining initial renderer compromise with this sandbox escape. Immediate enterprise-wide patching is essential to eliminate this critical post-compromise escalation vector.
Apply vendor patch: update Google Chrome to version 151.0.7922.72 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB