Description
Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-07-30
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Google Chrome contains insufficient validation of untrusted input in the Dawn rendering engine, which can be triggered by a crafted HTML page. The flaw allows a remote attacker to escape the sandbox, potentially executing arbitrary code on the host. The weakness corresponds to CWE-20 (Improper Input Validation) and CWE-1286 (Code Injection in Browser).

Affected Systems

The vulnerability impacts all Google Chrome installations using versions prior to 151.0.7922.72 across all platforms that employ the Dawn engine. Desktop users running unpatched Chrome are exposed.

Risk and Exploitability

The CVSS score of 7.1 places the vulnerability in the high severity range, but Chromium’s internal severity rating for this issue is medium. The EPSS score of less than 1% indicates that current exploitation opportunities are rare. The vulnerability is not listed in CISA KEV. The potential for sandbox escape remains significant if an attacker can deliver a crafted HTML page. Until the patch is applied, this remains a notable risk.

Generated by OpenCVE AI on August 3, 2026 at 11:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 151.0.7922.72 or later to apply the fixed Dawn input validation.
  • Enable Chrome's site isolation and sandboxed frames policies to further reduce the impact scope of rendering engine vulnerabilities.
  • Activate Chrome's Safe Browsing feature to block known malicious sites that could deliver crafted HTML content.

Generated by OpenCVE AI on August 3, 2026 at 11:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Thu, 30 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Insufficient validation of untrusted input in Dawn
Weaknesses CWE-1286
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

threat_severity

Moderate

Thu, 30 Jul 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-30T19:26:15.112Z

Reserved: 2026-07-27T23:35:07.866Z

Link: CVE-2026-17867

cve-icon Vulnrichment

Updated: 2026-07-30T19:26:10.251Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:50.610

Modified: 2026-08-03T17:43:31.443

Link: CVE-2026-17867

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-30T00:19:43Z

Links: CVE-2026-17867 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T12:00:16Z

Weaknesses
  • CWE-1286

    Improper Validation of Syntactic Correctness of Input

  • CWE-20

    Improper Input Validation