EUVD-2026-65849
GHSA-7qf2-24gc-9g82
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AV:N and UI:R reflect webpage delivery; AC:H captures the required renderer pre-compromise; S:C and C/I/A:H reflect full host OS impact via sandbox escape.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper input validation in Printing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome's Printing subsystem prior to 152.0.7977.65 allows an attacker who has already compromised the renderer process to execute arbitrary code outside Chrome's sandbox via a crafted HTML page. This is a two-stage, chained exploit: the printing component's failure to validate renderer-supplied input (CWE-20) becomes the second link used to break containment and reach the host OS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two distinct prerequisites that must both be satisfied. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.3 High score (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects severe potential impact tempered by meaningful attack prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first exploits a separate renderer-process vulnerability - such as a JavaScript engine or DOM memory corruption bug - to gain code execution within Chrome's sandboxed renderer when a target visits a malicious or attacker-controlled webpage. From within the compromised renderer, the attacker triggers a print operation and passes maliciously crafted input to the Chrome Printing subsystem, exploiting the improper input validation to achieve code execution outside the sandbox and at the host OS privilege level. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later, the vendor-confirmed patched release per the stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Chrome deployments across the organization and identify systems running versions prior to 152.0.7977.65, prioritizing workstations and servers with elevated access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today