EUVD-2026-50882
GHSA-3j82-fv3w-55rr
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network vector with required user interaction and no privileges, but code executes only inside the renderer sandbox (S:U), so host-level C/I/A impact is Low rather than High absent a chained escape.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Sandboxed remote code execution in Google Chrome desktop before 151.0.7922.72 lets a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's Scheduling component; Google rated it Chromium-Low severity and no public exploit has been identified, though the NVD CVSS of 8.8 reflects the high per-system impact once triggered. Exploitation requires user interaction (visiting a malicious page) and, because code executes inside the sandbox rather than escaping it, real-world impact is constrained absent a chained sandbox-escape bug.
Technical ContextAI
The vulnerability lives in Chrome's Scheduling subsystem, which governs how tasks and threads are prioritized and dispatched across the renderer and browser process model. The CWE-269 (Improper Privilege Management) classification indicates the root cause is a logic/implementation error in how scheduling handles privileges or capabilities, allowing an attacker-controlled HTML page to drive execution paths that result in arbitrary code running inside the renderer sandbox. Per the CPE (cpe:2.3:a:google:chrome:*), the affected component is the Google Chrome application itself; the sandbox is Chrome's multi-process containment boundary designed to prevent renderer-level compromise from reaching the host OS, so code execution 'inside a sandbox' is a materially different threat class than a full sandbox escape.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms; the fix ships in the Stable channel update documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates, so ensure the browser is fully closed and relaunched to apply the update, and verify the version via chrome://settings/help across your fleet. Users of Chromium-based browsers should apply their respective vendor's update once it incorporates the upstream fix. There is no supported configuration-based workaround for the flaw itself; as an interim compensating control you can restrict users from visiting untrusted sites via web-proxy/URL filtering and enforce enterprise auto-update policies to shorten exposure - the trade-off is that URL filtering cannot cover all attacker-controlled pages (e.g., malvertising on legitimate sites), so patching remains the only reliable fix.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today