EUVD-2026-66004
GHSA-35xr-2w3x-9wvx
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Sandbox escape warrants S:C; all other metrics align with chained renderer compromise requiring user interaction and high attack complexity.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper input validation in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome's Media component on Windows allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases on Windows prior to 152.0.7977.65. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential conditions to be satisfied: first, the attacker must have independently compromised the Chrome renderer process (a separate, prerequisite vulnerability not covered by this CVE); second, the victim must visit or be redirected to a crafted HTML page while using a Chrome version on Windows prior to 152.0.7977.65. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately captures the high complexity of this attack - it requires both user interaction and a pre-compromised renderer process, making it inherently a chained exploit rather than a standalone vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first compromises a victim's Chrome renderer process on Windows - for example, by chaining this attack with a separate renderer exploit delivered via a malicious or attacker-controlled website. Once the renderer is compromised, the attacker's crafted HTML page triggers the Media component's improper input validation flaw, causing code to execute outside the Chrome sandbox with broader OS-level access. … |
| Remediation | The primary fix is to update Google Chrome on Windows to version 152.0.7977.65 or later, confirmed by the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, begin deploying Google Chrome 152.0.7977.65 or later across all Windows systems and audit current Chrome versions in use throughout the organization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today