EUVD-2026-50897
GHSA-3wv5-vww2-4hrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryChrome Frame component parses malicious markup
-
ExploitTrigger out-of-bounds read in renderer
-
ExecutionLeak adjacent heap memory
-
ImpactChain toward potential code execution
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled content - the CVSS UI:R metric and the description's 'crafted HTML page' confirm user interaction (navigating to or rendering a malicious page/iframe) is mandatory; there is no server-side or zero-click path in the provided data. No authentication is required (PR:N) and it works remotely against default Chrome configurations below 151.0.7922.72. The primary limiting factors are the required user interaction, the renderer sandbox (an OOB read alone yields disclosure/instability, not automatic code execution without a sandbox-escape chain), and Chrome's rapid auto-update, which shrinks the exposure window; SSVC also marks it not automatable. |
| Impact | Signals conflict and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) implies full triad compromise, but Chromium's own security team rated the bug 'Low', and CWE-125 (a read primitive) rarely delivers integrity/availability=High by itself, so the NVD C:H/I:H/A:H may overstate realistic impact. CISA SSVC aligns with lower urgency: Exploitation 'none', Automatable 'no', though Technical Impact is 'total'. EPSS is 0.18% (8th percentile) and there is no KEV listing and no public exploit identified - consistent with a not-yet-exploited, UI-gated bug. Net: this is a routine same-day Chrome patch priority (browsers auto-update), not an emergency; the 8.8 headline is driven by NVD's optimistic impact metrics rather than by evidence of weaponization. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page containing crafted frame markup and lures a victim to visit it (phishing link, malvertising, or compromised site). When Chrome's Frame code processes the page it reads out of bounds, leaking adjacent memory that could expose sensitive process data or seed a larger exploit chain. No public exploit code has been identified, and success requires the user to actually load the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Out-of-bounds memory access in Google Chrome's Frame component affects all Desktop builds prior to 151.0.7922.72, letting a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Chromium rated the underlying flaw Low severity, yet NVD scores it 8.8 (High) and tags flag potential RCE; there is no public exploit identified at time of analysis and EPSS is a low 0.18% (8th percentile). A vendor patch is available and the issue is not listed in CISA KEV.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the Stable Desktop channel (chrome://settings/help forces the check-and-relaunch) as documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through your enterprise policy/patch-management channel and ensure users fully relaunch Chrome so the new binary loads. Because exploitation requires the victim to open a crafted page, interim compensating controls include enabling Site Isolation (default) and, for high-risk users, restricting untrusted browsing or using web-content filtering to reduce exposure to attacker pages; these reduce likelihood but do not remove the flaw, so patching remains the only complete fix. Users of other Chromium-based browsers should apply the equivalent vendor update once released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect lives in Chrome's Frame handling, part of the Blink rendering engine that manages nested browsing contexts (iframes, frame trees) inside the multi-process Chromium architecture. The root cause is CWE-125 (Out-of-bounds Read): logic in the frame code computes an index or length incorrectly and accesses memory past the end of an allocated buffer while parsing or processing attacker-controlled HTML. Per CPE data this affects cpe:2.3:a:google:chrome across versions below 151.0.7922.72. OOB reads in a renderer can leak adjacent heap contents (potentially defeating ASLR or exposing cross-site data) and, if the corrupted read feeds later control flow, may be chained toward the 'Potential RCE' outcome noted in the tags - though on its own an OOB read is primarily an information-disclosure/stability class.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs user interaction (UI:R, PR:N); CWE-125 OOB read primarily leaks memory (C:H) with possible crash (A:L) and no clear integrity impact, matching Chromium's Low rating.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop versions before 151.0.7922.72 contain an out-of-bounds memory access vulnerability in the Frame component with potential remote code execution capability; remote attackers can read sensitive memory when users open malicious HTML pages. Although a patch is available, this affects all desktop Chrome users organization-wide and poses risk of credential leakage, data exposure, and system compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Implementation and Policy Flaws
View all 50Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB