EUVD-2026-61227
GHSA-63wj-pc2v-448c
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network delivery via crafted page (AV:N), race condition timing plus pre-compromised renderer requirement (AC:H), user must visit page (UI:R), sandbox escape changes scope (S:C) with full host-level CIA impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Race condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape via race condition in Google Chrome's USB subsystem (all versions prior to 151.0.7922.169) enables arbitrary code execution on the host system when chained with a renderer process compromise. This is a second-stage exploit: an attacker must already have code execution within Chrome's sandboxed renderer before the USB TOCTOU race can be leveraged to cross the sandbox boundary, triggered through a crafted HTML page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two explicit prerequisites must both be satisfied for exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.3 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) signals a severe but non-trivial-to-exploit vulnerability: AC:H reflects both the race condition timing requirement and the prerequisite of a pre-compromised renderer, while S:C with the full-impact triad (C:H/I:H/A:H) confirms that a completed chain achieves host-level compromise beyond the browser sandbox. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first serves a malicious web page that exploits a separate Chrome renderer vulnerability - such as a JavaScript engine type confusion or media parser memory corruption - to gain code execution within Chrome's sandboxed renderer process. With renderer access established, the attacker then races the USB subsystem's TOCTOU window via a crafted HTML page, manipulating USB-related state between its check and use to escape the sandbox and execute arbitrary code in the browser process or on the host OS. … |
| Remediation | Update Google Chrome to version 151.0.7922.169 or later, available via Chrome's built-in auto-update mechanism or the stable-channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, issue an urgent security notice requiring all users to upgrade Chrome to version 151.0.7922.169 or later, and deploy endpoint policies to block execution of older versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today