EUVD-2026-74510
GHSA-v7x2-49m2-8h5p
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects the mandatory pre-compromised renderer prerequisite; S:C confirms sandbox escape to host OS; PR:N and UI:R match the crafted-page delivery model.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
DevTools injection (CWE-74) in Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to escape the Chromium sandbox and execute arbitrary code on the host system via a crafted HTML page. Chromium rated this 'High' severity; the CVSS 3.1 score of 8.3 (AC:H/S:C) accurately reflects the elevated complexity imposed by the prerequisite renderer compromise and the full scope-change impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential conditions: first, the attacker must have already achieved a compromised Chrome renderer process via a separate, independent renderer vulnerability; second, the victim must visit a crafted HTML page that triggers the DevTools injection (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a high-severity but complexity-constrained attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 153.0.8010.36. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of Chrome versions across your organization and flag all endpoints running versions prior to 153.0.8010.36, prioritizing systems used by developers, security teams, and users exposed to untrusted web content. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today