EUVD-2026-66020
GHSA-w8cr-x234-gm99
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered race condition requires no auth or interaction but AC:H for timing; C/I/A:H reflects full browser-scope impact; S:U because no sandbox escape occurs.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)
AnalysisAI
Remote code execution inside the Chrome sandbox is possible through a race condition in the Extensions component, exploitable via crafted network traffic against Google Chrome versions prior to 152.0.7977.65. Despite a CVSS score of 8.1, Chrome's own team rates this vulnerability Low severity - a notable divergence explained by the sandbox constraint: successful exploitation yields in-sandbox code execution rather than full OS-level compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running Google Chrome prior to version 152.0.7977.65 with the Extensions component active (i.e., at least one extension installed or the extensions framework enabled, which is the default state). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly encodes network accessibility and full CIA impact within scope, but the AC:H and S:U are the critical limiting factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker serves or injects specially crafted network traffic - for example via a malicious website, a compromised CDN response, or a man-in-the-middle position - timed to trigger a race condition in Chrome's Extensions component while it processes network events. If the attacker successfully wins the timing race within the TOCTOU window, they achieve arbitrary code execution within the Chrome sandbox, potentially accessing browser-stored credentials, session cookies, and extension data. … |
| Remediation | The primary fix is to update Google Chrome to version 152.0.7977.65 or later via the Chrome stable channel update (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, communicate the vulnerability to Chrome users and obtain Chrome version 152.0.7977.65 or later from Google's official update channels. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today