EUVD-2026-50861
GHSA-5jcv-xqp8-f3wf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to malicious page
-
DeliveryDeliver crafted HTML with malformed media
-
ExploitTrigger heap overflow in codec parser
-
ExecutionCorrupt renderer heap
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome build (before 151.0.7922.72) that reaches the affected Codecs decoding path - i.e., a crafted HTML page containing malformed media that Chrome parses. The CVSS UI:R confirms user interaction is mandatory: the user must navigate to or render the malicious page, so there is no zero-click or unauthenticated-server-side vector. A key limiting factor is scope: code execution is contained within the renderer sandbox (S:U, 'inside a sandbox'), so achieving impact on the host OS requires an additional sandbox-escape vulnerability not covered by this CVE. No special non-default configuration is required beyond running an unpatched Chrome desktop build and processing the malicious media. |
| Impact | The signals are mixed and worth reconciling. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) reflects network reachability, low complexity, no privileges, and high impact, but requires user interaction (visiting a page) and shows an unchanged scope (S:U) - consistent with corruption bounded to the renderer sandbox. Real-world exploitation pressure is low: EPSS is 0.24% (15th percentile), CISA SSVC records Exploitation: none / Automatable: no / Technical Impact: total, Google's own Chromium severity is Low, and no public exploit is identified. The 'Technical Impact: total' in SSVC aligns with full control of the compromised (sandboxed) process, not the host. Bottom line: the raw 8.8 overstates practical risk for most defenders because impact is sandbox-contained and there is no evidence of exploitation, yet browser codec bugs are historically valuable in exploit chains, so it should still be patched on a normal browser-update cadence rather than treated as an emergency. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted media that exercises the vulnerable codec path and lures a user to visit it (via link, ad, or compromised site). When Chrome decodes the content it triggers the heap overflow, giving the attacker arbitrary code execution within the renderer sandbox; a full host compromise would require chaining a separate sandbox-escape bug. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome desktop before 151.0.7922.72 arises from a heap buffer overflow in the browser's media Codecs component (CWE-122), letting a remote attacker who serves a crafted HTML page corrupt heap memory and run arbitrary code - though execution is confined inside the renderer sandbox rather than the host OS. Google rates the Chromium severity as Low despite the NVD-style 8.8 CVSS, and there is no public exploit identified at time of analysis; EPSS is low at 0.24% (15th percentile) and CISA SSVC lists exploitation as none. A vendor patch is available in the 151.0.7922.72 stable channel release.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later on the stable desktop channel via Help > About Google Chrome (which triggers the update) followed by a browser relaunch, per Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the updated version through your existing browser management/MDM policy and force a relaunch to apply it. If patching must be delayed, the practical compensating control is to reduce exposure to untrusted media content - for example enforcing Site Isolation (default on) and restricting browsing to trusted sites; note that disabling media codecs is not a supported end-user configuration and blunt network filtering of media is impractical, so upgrading remains the only reliable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Chrome's Codecs subsystem, the media-decoding path that parses and renders audio/video streams embedded in web content. CWE-122 (heap-based buffer overflow) means attacker-controlled input - malformed codec/container data delivered through an HTML page - causes a write past the bounds of a heap allocation, corrupting adjacent heap metadata or objects and creating a controllable memory-corruption primitive that can be steered toward code execution. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome desktop application. Notably, the description states execution occurs 'inside a sandbox,' indicating the bug compromises the sandboxed renderer process and does not by itself constitute a sandbox escape to the underlying operating system, which typically requires a second chained vulnerability.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs user to visit (UI:R) but no auth (PR:N); overflow gives full control of the sandboxed renderer (C/I/A:H) with no scope change to the host (S:U).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Heap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions before 151.0.7922.72 contain a remote code execution vulnerability that affects all employees using Chrome. While current threat intelligence shows no active exploitation and the browser's sandbox architecture prevents system-level compromise, timely patching is required to maintain endpoint security standards and reduce long-term risk exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB