EUVD-2026-63597
GHSA-pgq9-pv57-hvch
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N), race condition requires precise timing (AC:H), no auth needed (PR:N), user must visit page (UI:R), impact sandboxed (S:U) with full code execution within that scope (C:H/I:H/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution within the Chrome sandbox is possible via a race condition (TOCTOU) in the V8 JavaScript engine, affecting Google Chrome prior to version 151.0.7922.173. An unauthenticated attacker who persuades a victim to visit a crafted HTML page can trigger the race condition during JavaScript execution, achieving high confidentiality, integrity, and availability impact within the renderer sandbox. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.173 and to actively navigate to or be redirected to an attacker-controlled HTML page - passive exploitation without user browser interaction is not possible, as confirmed by the UI:R CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (High) accurately captures the network-reachable, unauthenticated attack surface while the AC:H metric reflects the genuine difficulty of reliably triggering a race window in a multi-threaded JIT engine - this is not a push-button exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious HTML page containing JavaScript engineered to race two concurrent V8 execution paths against each other, collapsing the TOCTOU window to corrupt heap state in the renderer process. When a targeted user opens the page in an unpatched Chrome browser, the race fires and yields arbitrary code execution within the renderer sandbox, potentially enabling data exfiltration from the browser process or serving as the first stage of a two-step exploit chain if paired with a sandbox escape. … |
| Remediation | Upgrade Google Chrome to version 151.0.7922.173 or later immediately; this is the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0404570826.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Chrome deployments across the organization and issue a security alert to end users advising against visiting untrusted websites until patching is complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today