Executive brief
A vulnerability in Google Lens within the Google Chrome browser could allow a remote attacker to bypass security protections. If an attacker has already compromised the part of the browser that displays web pages, they could use this flaw to escape the browser's 'sandbox,' which is designed to keep malicious code from affecting the rest of the computer. This could lead to unauthorized access to the user's operating system or personal files.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Google Lens component of Google Chrome. The flaw allows a remote attacker to perform a sandbox escape, provided they have already achieved code execution within the renderer process (e.g., via a separate exploit). By enticing a user to visit a specially crafted HTML page, the attacker can leverage the insufficient validation to break out of the process isolation. This issue was addressed in Chrome version 151.0.7922.72 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in version 151.0.7922.72
- 2026-07-30: disclosed