EUVD-2026-50834
GHSA-6946-9r36-jh5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise Chrome renderer process (prior bug)
-
DeliveryServe crafted HTML page
-
ExploitTrigger Audio use-after-free
-
ExecutionReclaim freed allocation across boundary
-
PersistEscape sandbox to browser process
-
ImpactExecute code at host privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process - this is a chained sandbox-escape primitive, not an initial-access vulnerability, and it cannot be triggered against a healthy renderer alone. The attacker must then get the victim to load a crafted HTML page that exercises the vulnerable Audio code path (UI:R - user interaction/navigation required). It is limited to Chrome (and Chromium-derived) builds prior to 151.0.7922.72; the requirement for a pre-existing renderer foothold plus victim navigation substantially raises the real-world bar despite the CVSS PR:N rating. |
| Impact | Signals are mixed and should be read in context. The CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects the total-impact sandbox escape and scope change, and SSVC records Technical Impact: total. However, the same CVSS PR:N is misleading in isolation: the description explicitly states the attacker must have ALREADY compromised the renderer process, so in practice this is a chained second-stage bug, not a standalone remote-unauthenticated RCE. SSVC Exploitation: none and Automatable: no, combined with a low EPSS of 0.29% (21st percentile) and no KEV listing, indicate this is not currently under active exploitation and not trivially wormable. It is a real priority to patch (memory-corruption sandbox escapes are prime exploit-chain components), but the practical risk today is moderate and gated behind a prior renderer compromise. Note the tag 'Denial Of Service' understates impact - the CWE and CVSS point to memory-corruption/code-execution, not merely DoS. |
| Exploit ScenarioDerived | An attacker first lands remote code execution inside Chrome's sandboxed renderer (e.g., via a separate renderer bug), then serves a crafted HTML page that drives the Audio component to trigger the use-after-free and reclaim the freed allocation. By controlling the reused memory across the process boundary, they escalate out of the sandbox to the browser process, converting a contained renderer compromise into full-privilege code execution on the host. No public exploit code is identified at time of analysis, and the attack requires the victim to load the malicious page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Audio component to break out of the sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to scope change, this is a second-stage exploit primitive rather than an initial-access bug; no public exploit has been identified at time of analysis and EPSS is low at 0.29%. A vendor patch is available in Chrome 151.0.7922.72.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later on Windows, macOS, and Linux and fully relaunch the browser so the new binaries load (Chrome auto-updates but requires a restart to complete). Verify via chrome://settings/help and, in managed fleets, push the update through your enterprise update policy or MDM rather than relying on per-user restarts. There is no practical feature-level workaround for a renderer-to-browser sandbox escape since it lives in the Audio path exercised by ordinary web content; as an interim compensating control for high-risk endpoints, restrict browsing to trusted sites and enforce prompt update rollout, accepting that these do not neutralize the underlying bug. Users of other Chromium-based browsers should apply their vendor's build that incorporates the corresponding Chromium fix. Advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Audio subsystem, the code path that handles audio rendering/streaming between the sandboxed renderer and the browser process. Use-after-free occurs when memory is freed but a dangling pointer is later dereferenced, allowing an attacker to control the reused allocation and corrupt object state. Because the Audio service interacts across Chromium's multi-process privilege boundary, corrupting it from a compromised renderer can yield code execution at a higher-privilege level, hence the CVSS Scope:Changed (S:C). The single CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms Google Chrome (all channels prior to the fix) as the affected product; the reused Chromium engine means Chromium-derived browsers may share the underlying code but are not enumerated in this record.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Requires a pre-compromised renderer foothold (PR:L) and reliable memory-reclamation plus victim navigation (AC:H, UI:R); success escapes the sandbox across a privilege boundary (S:C) with total impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Audio in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17708, CVSS 9.6) that allows attackers with renderer-level code execution to elevate privileges to system level. While the technical severity is high, actual exploitation likelihood is low (EPSS 0.3%) and requires pre-existing compromise of the Chrome rendering process. Organizations must prioritize Chrome patching to defend against privilege escalation in targeted attack scenarios.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB