EUVD-2026-50818
GHSA-j42h-vr42-mvr8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Requires a pre-compromised renderer (PR:L) and non-trivial UAF timing (AC:H) plus user interaction; sandbox escape crosses a trust boundary (S:C) with full host impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
AnalysisAI
Sandbox escape in Google Chrome on Windows before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process leverage a use-after-free in the DataTransfer component (clipboard/drag-and-drop data) to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 driven by scope change and full CIA impact, though EPSS is low (0.29%) and there is no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process - this is a sandbox-escape/second-stage bug, not an initial-access vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects the scope-changing sandbox-escape impact, but the raw score overstates standalone risk because exploitation presupposes the attacker has already compromised the renderer - a prerequisite the CVSS PR:N metric does not capture. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first achieves code execution inside Chrome's renderer via a separate vulnerability, then serves a crafted HTML page that manipulates clipboard/drag-and-drop DataTransfer objects to trigger the use-after-free and corrupt memory in the browser process. With user interaction (e.g., interacting with the page), the attacker escapes the renderer sandbox to gain higher-privileged execution on the Windows host. … |
| Remediation | Vendor-released patch: 151.0.7922.72 - update Google Chrome on Windows to 151.0.7922.72 or later, per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows systems running Chrome and determine which handle sensitive workloads or administrative functions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today