EUVD-2026-50818
GHSA-j42h-vr42-mvr8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate bug
-
DeliveryServe crafted HTML page
-
ExploitTrigger DataTransfer use-after-free
-
ExecutionCorrupt browser-process memory
-
ImpactEscape sandbox to host privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process - this is a sandbox-escape/second-stage bug, not an initial-access vector. The target must be running Chrome on Windows below 151.0.7922.72. Per the CVSS vector, user interaction is required (UI:R), meaning the victim must engage with the crafted HTML page (e.g., a drag-and-drop or clipboard interaction consistent with the DataTransfer component). The limiting factors that reduce realistic risk: the renderer-compromise prerequisite, the required user interaction, and Windows-only scope; without an existing renderer foothold this vulnerability cannot be triggered on its own. |
| Impact | The CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects the scope-changing sandbox-escape impact, but the raw score overstates standalone risk because exploitation presupposes the attacker has already compromised the renderer - a prerequisite the CVSS PR:N metric does not capture. Real-world signals temper this: EPSS is only 0.29% (21st percentile), the vulnerability is NOT on CISA KEV, and no public exploit has been identified, indicating no observed widespread exploitation. There is no SSVC record provided. The practical priority is high for any browser-fleet patch cycle given Chrome's ubiquity and the sandbox-escape class, but this is a chain component (needs a prior renderer RCE plus user interaction), so it is a strong 'patch promptly' rather than an emergency zero-day. Note the conflict worth flagging: CVSS PR:N implies no privileges, yet the description explicitly requires a pre-compromised renderer - treat the description as authoritative on prerequisites. |
| Exploit ScenarioDerived | An attacker first achieves code execution inside Chrome's renderer via a separate vulnerability, then serves a crafted HTML page that manipulates clipboard/drag-and-drop DataTransfer objects to trigger the use-after-free and corrupt memory in the browser process. With user interaction (e.g., interacting with the page), the attacker escapes the renderer sandbox to gain higher-privileged execution on the Windows host. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome on Windows before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process leverage a use-after-free in the DataTransfer component (clipboard/drag-and-drop data) to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 driven by scope change and full CIA impact, though EPSS is low (0.29%) and there is no public exploit identified at time of analysis. It is not on CISA KEV and requires an existing renderer compromise plus user interaction, making it a second-stage bug in an exploit chain rather than a standalone entry point.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome on Windows to 151.0.7922.72 or later, per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates, but confirm the version via chrome://settings/help and relaunch to apply, and push the update through enterprise management (Google Update / group policy) to ensure fleet coverage. Since this bug requires a pre-compromised renderer as a chain link, defense-in-depth that reduces initial renderer compromise helps: enable site isolation (default on) and consider enabling the enhanced/strict Safe Browsing setting to reduce exposure to malicious pages, with the trade-off of some telemetry sent to Google and occasional false-positive warnings. There is no need to disable DataTransfer/clipboard functionality as a workaround; patching is straightforward and the primary control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in DataTransfer, the Blink/Chromium object that backs clipboard and drag-and-drop data exchanged between web content and the browser. A use-after-free occurs when memory is freed but a dangling reference is later dereferenced, allowing an attacker to control the reused allocation and corrupt program state. Because DataTransfer bridges the sandboxed renderer and higher-privileged browser process, corrupting it is a path to escaping the renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome on Windows; Chromium tagged it High severity and it is tracked internally as chromium issue 517350808.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Requires a pre-compromised renderer (PR:L) and non-trivial UAF timing (AC:H) plus user interaction; sandbox escape crosses a trust boundary (S:C) with full host impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
Google Chrome on Windows contains a critical vulnerability that undermines the browser's security isolation, potentially allowing attackers to gain system-level access through sophisticated multi-stage attacks. While direct exploitation is currently limited by technical prerequisites and low real-world prevalence, the vulnerability poses material risk to organizations against targeted threats. Immediate patching is essential to maintain defenses against advanced adversaries.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB