Google Chrome EUVD-2026-63599

The sole triggering condition is a user running Google Chrome prior to version 151.0.7922.173 loading or navigating to a crafted HTML page - no special Chrome configuration, extension state, or server-side setup is required. The CVSS vector (PR:N/UI:R) confirms exploitation requires no authentication and no elevated privileges on the victim system; any unpatched Chrome instance is potentially vulnerable regardless of platform, extensions, or user settings. Exploitation is constrained by the required user interaction (UI:R): the victim must actively navigate to or load the attacker-controlled page, meaning passive drive-by without any click is not achievable. Chrome's sandbox normally contains renderer-level exploits, but this flaw specifically achieves execution outside that sandbox, removing the primary browser containment layer and making successful exploitation equivalent to OS-level code execution.

The CVSS 8.8 base score reflects a full-impact triad (C:H/I:H/A:H) with a low-complexity, no-privilege, network-reachable attack (AV:N/AC:L/PR:N) gated only by user interaction (UI:R). One notable tension: the vendor-assigned CVSS vector uses S:U (scope unchanged), yet the description explicitly states execution 'outside the sandbox' - a sandbox escape in Chrome's architecture typically implies a scope change affecting the broader OS, which would justify S:C. Defenders should verify against Google's Chromium issue tracker (issues.chromium.org/issues/543798025, likely access-restricted) whether this constitutes a true sandbox bypass or code execution already within a partially-compromised process boundary. EPSS of 0.39% at the 32nd percentile indicates low current exploitation probability, and the absence of a CISA KEV listing with no identified public POC suggests this is not under active widespread exploitation at time of analysis. Despite modest exploitation signals, the sandbox-escape framing and ubiquitous Chrome deployment mean even organizations with limited patch capacity should treat this as high-priority, as a working exploit would require only a single user click to achieve OS-level impact.

An attacker registers or compromises a web domain and serves a crafted HTML page that causes Chrome's Network component to process malformed data, triggering the heap-based buffer overflow. A target user is lured to the page via phishing email, malvertising on a legitimate ad network, or a watering-hole attack on a site the victim frequents - upon page load, the overflow corrupts heap memory, enabling attacker-controlled code to execute outside Chrome's sandbox with OS-level privileges. No public POC code has been identified at time of analysis, though the low-complexity, network-accessible nature of the flaw (AV:N/AC:L) means a working exploit requires only a valid heap corruption primitive, not chaining additional bugs.