EUVD-2026-54123
GHSA-g7px-3q98-p26j
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AV:N and UI:R because victim must visit attacker page; AC:H reflects required renderer pre-compromise prerequisite; S:C and C:H/I:H/A:H reflect confirmed full sandbox escape to host OS.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome prior to 151.0.7922.109 allows a remote attacker who has already compromised the renderer process to break out of Chrome's isolation boundary via a crafted HTML page exploiting insufficient Navigation policy enforcement (CWE-693). This is a second-stage exploit primitive: it elevates a sandboxed renderer breach into full host OS code execution at browser-process privilege, crossing Chrome's core security boundary as reflected in the CVSS Scope:Changed metric. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-confirmed patch shipped in the 151.0.7922.109 stable channel update.
Technical ContextAI
Google Chrome's multi-process architecture isolates web content inside sandboxed renderer processes that are prevented from directly accessing the host OS. The Navigation component manages cross-origin transitions, process selection, and privilege boundary enforcement as pages load. CWE-693 (Protection Mechanism Failure) identifies the root cause as a failure to enforce an expected security policy in this Navigation layer - allowing a renderer-level attacker to leverage a crafted navigation sequence to breach sandbox controls. The CVSS S:C (Scope Changed) metric confirms the vulnerability crosses from the renderer security domain into the browser process or OS context. Affected scope covers all Chrome desktop versions below 151.0.7922.109, per EUVD-2026-54123 and the upstream Chromium issue tracker (issues.chromium.org/issues/531165110).
RemediationAI
Update Google Chrome to version 151.0.7922.109 or later, confirmed as the patched release per the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome auto-updates by default; administrators managing enterprise fleets should verify rollout via policy or fleet management tooling. For environments where immediate patching is not feasible, restrict access to untrusted external web content via Chrome enterprise policies, enable Enhanced Safe Browsing to increase renderer exploit detection, and evaluate browser isolation products that prevent renderer-level code from accessing host resources. Operators of Chromium-based browsers should monitor their vendors for corresponding patches integrating the upstream Chromium fix at https://issues.chromium.org/issues/531165110.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today