EUVD-2026-35203
GHSA-prmr-q74g-m753
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim loads crafted HTML in Chrome on Mac
-
DeliveryAttacker leverages prior network-process compromise
-
ExploitTrigger race condition in Network service
-
ExecutionWin timing window to corrupt shared state
-
PersistEscape Chrome sandbox to broader process context
-
ImpactExecute code outside renderer/network sandbox on macOS host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the target running Google Chrome on macOS at a version older than 149.0.7827.103, (2) the attacker already having compromised the Chrome Network process via a separate vulnerability (this CVE is a sandbox-escape primitive, not initial access), (3) the victim loading attacker-controlled HTML in that Chrome instance (UI:R), and (4) winning a race condition in the Network service (AC:H), which is non-deterministic. Limiting factors: macOS-only, not the default Windows/Linux build; the bug is not standalone - without a prior network-process RCE it is not directly reachable; and the High attack complexity means exploitation is not reliably automatable. |
| Impact | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H yields an 8.3 score reflecting network reach, scope change (sandbox escape), and full CIA impact, but tempered by High attack complexity (winning a race) and required user interaction (visiting a crafted page). Critically, exploitation presupposes the attacker has already compromised the network process, so this is realistically a second-stage bug chained with a separate renderer/network RCE rather than a standalone entry point. No EPSS, KEV, or POC data is provided, so the bug is rated 'no public exploit identified at time of analysis'; Chromium's internal severity of High and the typical pattern of browser sandbox escapes being chained by sophisticated actors mean defenders should still patch promptly even though widespread opportunistic exploitation is unlikely. |
| Exploit ScenarioDerived | A targeted user on macOS visits a malicious or compromised website serving crafted HTML; an attacker who has chained a prior renderer/network-process RCE then races shared state in Chrome's Network service to escape the sandbox and execute code with the broader privileges of the browser process on the host. Because the bug requires both a pre-existing network-process compromise and winning a timing race, realistic use is in advanced multi-stage exploit chains (e.g., targeted spyware) rather than commodity drive-by attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Sandbox escape in Google Chrome on macOS versions prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer/network process to break out of the browser sandbox via a race condition triggered by a crafted HTML page. Chromium rates the severity as High and a vendor patch is available, though no public exploit has been identified at time of analysis.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 or later for macOS - upgrade via Chrome's built-in updater or by relaunching the browser, and verify the version under chrome://settings/help. Enterprises managing Chrome with policy should push the updated MSI/PKG through their endpoint management tooling and confirm rollout on Mac fleets; see the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. No formal workaround is published; as a compensating control until patching completes, restrict browsing of untrusted content on Mac endpoints (e.g., enforce SafeSearch/URL allowlists or route browsing through a remote-browser isolation gateway), accepting the productivity trade-off, since the bug requires the user to load a crafted HTML page.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Chrome's Network service component on macOS, which runs in a sandboxed process as part of Chromium's multi-process site isolation architecture. CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e. a race condition) indicates that two or more concurrent code paths in the Network process access shared state without adequate locking, creating a window in which an attacker who already controls that process can manipulate state to violate sandbox boundaries. Successful exploitation undermines the renderer/network sandbox, which is the last line of defense before host-level code execution on macOS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Race in Network in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the network process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on macOS (versions prior to 149.0.7827.103) contains a sandbox escape vulnerability that allows attackers who have already compromised the browser's renderer process to break out of the sandbox and gain system-level access. This escalation risk is significant for macOS-based organizations as it could enable lateral movement and data exfiltration following an initial browser compromise. Immediate patching across all macOS endpoints is required to close this attack path.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB