EUVD-2026-74323
GHSA-jqgh-2xhh-3xpr
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N and AC:H reflect network delivery requiring prior renderer compromise; S:C corrects the provided S:U since execution 'outside the sandbox' is definitionally a scope change.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
6DescriptionCVE.org
Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome's Extensions component (versions prior to 153.0.8010.36) permits an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via crafted network traffic. The missing authorization check (CWE-862) in the Extensions subsystem fails to enforce inter-process privilege boundaries, converting a renderer-level foothold into host-level code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has already achieved code execution within the Chrome renderer process via a separate, independent vulnerability - this is a non-default, high-complexity precondition that significantly limits opportunistic exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is meaningfully constrained by the AC:H prerequisite: successful exploitation requires the attacker to have already achieved renderer process compromise via a separate, independent vulnerability, making this a second-stage exploit in a chained attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 153.0.8010.36. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Chrome deployments across the organization and identify systems running versions prior to 153.0.8010.36. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today