EUVD-2026-50878
GHSA-4cwj-qj59-c6vc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Chrome extension
-
DeliverySocial-engineer user to install
-
ExploitAbuse inappropriate V8 implementation
-
ExecutionExecute arbitrary code in sandbox
-
ImpactCompromise browsing context data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to convince the victim to install a specific crafted/malicious Chrome extension - the exact concrete prerequisite stated in the description (UI:R). This is not a drive-by web attack: default Chrome running only trusted extensions is not exposed. Limiting factors include the required user interaction (manual extension installation), high attack complexity (AC:H), confinement of resulting code to the browser sandbox (S:U - no OS-level escape stated), and that the target must run Chrome older than 151.0.7922.72. These constraints substantially reduce realistic risk relative to the 7.5 score. |
| Impact | Signals are largely consistent in pointing to modest real-world risk despite the 7.5 (High) CVSS score. The CVSS vector AV:N/AC:H/PR:N/UI:R shows network reachability but high attack complexity and required user interaction (installing a malicious extension), while S:U confirms impact stays within the sandbox rather than escaping it. SSVC reinforces this: Exploitation 'none', Automatable 'no' (each victim must be individually social-engineered), and Technical Impact 'total' only within the compromised context. Google's own Chromium severity rating is Low, contrasting with the numeric 7.5 - the C:H/I:H/A:H impact metrics inflate the score even though compromise is confined to a sandbox the user chose to expand by installing the extension. No EPSS score was provided in the input, and there is no KEV listing or POC, so this is a low-priority, non-widespread issue best handled through routine Chrome auto-update rather than emergency patching. |
| Exploit ScenarioDerived | An attacker publishes or side-loads a seemingly benign Chrome extension and uses social engineering to convince a victim to install it; once loaded, the extension leverages the inappropriate V8 implementation to execute arbitrary code inside the browser sandbox, gaining control over the browsing context (data, sessions, page content). Given AC:H and UI:R, the attack is not automatable and must target users one at a time; no public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox-constrained arbitrary code execution in Google Chrome's V8 JavaScript engine affects all desktop builds prior to 151.0.7922.72, where a crafted Chrome extension abuses an inappropriate V8 implementation to run attacker code inside the renderer sandbox. Exploitation requires convincing a user to install a malicious extension, and Google internally rated the Chromium security severity as Low. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none'.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 - update to this stable-channel build or later, which for most users happens automatically via Chrome's background updater (verify at chrome://settings/help and relaunch). The advisory is https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation depends entirely on the user installing a malicious extension, the most effective compensating control is to restrict extension installation: in managed environments use the ExtensionInstallBlocklist/ExtensionInstallAllowlist enterprise policies to permit only vetted Chrome Web Store extensions, trading some user flexibility for a smaller attack surface. Users should remove unknown or untrusted extensions and avoid side-loading unpacked extensions until updated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in V8, Chrome's high-performance JavaScript and WebAssembly engine, and is classified as CWE-269 (Improper Privilege Management). Rather than a memory-corruption bug, this is an 'inappropriate implementation' - a logic/privilege-boundary defect where the extension execution context reaches capabilities it should not, allowing a crafted extension to execute arbitrary code within V8. Critically, the resulting code runs inside the Chrome sandbox, so the boundary crossed is the extension/renderer privilege model, not an OS-level sandbox escape. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome desktop application across affected versions.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Requires convincing a user to install a malicious extension (UI:R, AC:H, PR:N); code runs within the sandbox (S:U) with total impact on that context, so C/I/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a code execution vulnerability in the V8 JavaScript engine that can be exploited through malicious browser extensions. While no active exploitation has been confirmed, the flaw affects all Chrome desktop users organization-wide and could allow attackers to bypass security boundaries if users install compromised extensions. Immediate patching is critical to eliminate this attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB