EUVD-2026-50849
GHSA-h5r7-76mx-726x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer process (prior bug)
-
DeliveryServe crafted HTML page
-
ExploitTrigger use-after-free in Media component
-
ExecutionCorrupt freed memory across sandbox boundary
-
ImpactEscape sandbox to higher privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (an explicit prerequisite stated in the CVE description) and can then deliver a crafted HTML page that drives the vulnerable Media code path; the platform is limited to Google Chrome on Windows before 151.0.7922.72. Limiting factors: the renderer-compromise prerequisite means this is a chained second-stage primitive, not standalone; UI:R indicates user interaction (visiting/rendering attacker-controlled content) is needed; and AC:H reflects the reliability/setup burden of the memory-corruption trigger. Users on 151.0.7922.72 or later, or on non-Windows builds as scoped here, are not exposed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, score 8.3) reflects a network-reachable, scope-changing bug with full confidentiality/integrity/availability impact but high attack complexity and required user interaction. The most important limiting signal is embedded in the description rather than the vector: exploitation presupposes the attacker has ALREADY compromised the renderer process, so this is a second-stage escalation primitive, not a standalone drive-by. That precondition is why AC:H is assigned and why real-world risk is lower than the 8.3 headline suggests. Corroborating this, EPSS is only 0.21% (11th percentile), it is not listed in CISA KEV, and no public exploit is identified - indicating no evidence of widespread or active exploitation. No SSVC decision data was provided. Net: a genuinely serious memory-corruption bug worth patching promptly given Chrome's ubiquity, but current evidence points to it being a chained/targeted concern rather than an imminent mass-exploitation threat. |
| Exploit ScenarioDerived | An attacker first compromises a Chrome renderer process (for example by chaining a separate renderer-RCE bug), then serves a crafted HTML page that triggers the use-after-free in the Media component to corrupt memory in a more privileged process and escape the sandbox. Given AC:H and the required renderer foothold, this is a realistic component of a two-bug exploit chain rather than a one-click compromise. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's Media component on Windows (versions before 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox through a crafted HTML page, exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it enables a scope-changing escalation from constrained renderer code to broader host access. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.21% (11th percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Windows via the Stable channel, per https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html - restart the browser to ensure the update is applied, since Chrome staging can leave an outdated binary running. In managed environments, push the update through your enterprise update policy and verify the effective version on endpoints. Because exploitation requires a prior renderer compromise, compensating controls that reduce initial renderer takeover help in the interim: enable the Windows/Chrome site-isolation and sandbox hardening that ship by default (do not disable them), enforce enterprise policies restricting untrusted media/plugin content, and prioritize patching internet-facing and high-risk user endpoints. These are stopgaps only - none substitute for the upgrade, and the media pipeline cannot be selectively disabled without breaking core browsing functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Chrome's Media subsystem, which handles decoding and playback of audio/video content delivered via HTML and web APIs. CWE-416 (use-after-free) means a heap object in the media pipeline is freed while a reference to it remains live, and subsequent access to that dangling pointer allows an attacker to control freed memory and corrupt browser process state. Because media parsing runs partly in the privileged browser process outside the renderer sandbox, a use-after-free reachable across that boundary can be leveraged for a sandbox escape. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies Google Chrome as the affected application; the issue is specific to the Windows build prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H and UI:R reflect the required prior renderer compromise plus crafted-page interaction; S:C with C/I/A:H captures the sandbox escape from renderer to a more privileged process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on Windows contains a sandbox escape vulnerability (CVE-2026-17723, CVSS 8.3) affecting versions before 151.0.7922.72 that allows attackers with renderer process compromise to escalate access to the underlying host system. While no public exploit has been identified and likelihood remains low (0.2% EPSS), the scope change from sandbox-constrained code to full host access creates material risk for organizations with sensitive data on Windows workstations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB