EUVD-2026-63600
GHSA-7xgw-3jr6-3p8h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AC:H reflects mandatory pre-compromised renderer prerequisite; S:C captures sandbox escape crossing trust boundary to host process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome's Linux Toolkit Theming component (prior to 151.0.7922.173) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. This is a two-stage attack: the renderer must be compromised first, then this CWE-913 flaw in the theming subsystem is leveraged to break out of the sandbox entirely, achieving host-level code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two distinct conditions to both be satisfied: first, the attacker must have already achieved code execution within the Chrome renderer process (a separate, preceding vulnerability is required for this stage); second, the victim must be running Google Chrome on a Linux operating system with the Linux Toolkit Theming component active, which is the default configuration for Linux Chrome installs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) materially overstates real-world exploitability because it fails to capture a critical prerequisite: the attacker must have already compromised the renderer process before this vulnerability is useful. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A targeted attacker first exploits a separate renderer-process vulnerability (e.g., a V8 type confusion or out-of-bounds read bug) to gain code execution inside Chrome's sandboxed renderer on a Linux system, achieved by luring the victim to a specially crafted webpage. With renderer control established, the attacker triggers the Linux Toolkit Theming flaw by manipulating dynamically managed resource references within the theming pipeline, causing improper resource control that crosses the sandbox boundary. … |
| Remediation | Upgrade Google Chrome to version 151.0.7922.173 or later, which contains the vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0404570826.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and enumerate all Chrome deployments on Linux systems across the enterprise, and assess user exposure based on web content accessed and system criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today