EUVD-2026-50821
GHSA-rhr6-p3mg-3gqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious WebGL/GPU content
-
ExploitTrigger inappropriate implementation in ANGLE
-
ExecutionEscape renderer sandbox on macOS
-
ImpactGain higher-privilege code execution on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Requires the victim to load a crafted HTML page in a vulnerable Google Chrome (before 151.0.7922.72) on macOS - user interaction (UI:R) is mandatory, so there is no zero-click path. Exploitation is limited to the macOS platform specifically (the flaw is scoped 'on Mac'), and realistically depends on ANGLE processing attacker-controlled graphics content (WebGL/GPU commands), meaning graphics acceleration being active increases exposure. No authentication is required (PR:N) and complexity is low (AC:L), so any user who visits the malicious page while running an unpatched Mac Chrome is at risk; the 'potentially' framing suggests full escape may require chaining with an additional renderer flaw. |
| Impact | The signals here are partially in tension and warrant judgment. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) reflects a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (loading a crafted page), with a scope change reflecting the sandbox escape from renderer to host - hence the very high score. However, EPSS is only 0.29% (21st percentile), indicating low modeled probability of exploitation in the near term, and there is no KEV listing and no public exploit identified, so this is not confirmed active exploitation. This is a genuinely serious browser vulnerability by impact (sandbox escape is a high-value primitive, usually chained), but real-world urgency is tempered: Chrome auto-updates rapidly, the flaw is macOS-specific, and no weaponization is evidenced. Note the description hedges with 'potentially perform a sandbox escape,' meaning the full impact may depend on chaining with a renderer-compromise bug - the CVSS treats it as full C/I/A high, which may be an upper-bound assumption. Priority: patch promptly given the impact and trivial exploitation preconditions, but there is no signal of imminent mass exploitation. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious web page containing crafted WebGL/graphics content that abuses the ANGLE implementation flaw; a macOS user running a vulnerable Chrome merely visits the page (via phishing link, malvertising, or compromised site) and the content triggers a sandbox escape from the renderer. Because AC is low and no privileges are needed beyond the victim opening the page, delivery is straightforward, though in practice this primitive is typically chained with a renderer bug for full code execution. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome on macOS (versions prior to 151.0.7922.72) stems from an inappropriate implementation in ANGLE, Chrome's graphics abstraction layer, allowing a remote attacker to break out of the renderer sandbox via a crafted HTML page after the victim loads it. Rated High by Chromium and carrying a CVSS 9.6 (scope-changed), it enables an attacker to escalate from web content into higher-privilege execution on the host. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.29%, 21st percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Stable channel (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome typically auto-updates, so ensure the update is applied and fully relaunch the browser to load the patched binary, then verify via chrome://version. In managed fleets, push the update through your enterprise management/MDM channel and confirm the minimum version policy. Until the update is applied, compensating controls include disabling hardware-accelerated graphics/WebGL to reduce ANGLE's attack surface (Settings > System > 'Use graphics acceleration when available' off, or the #ignore-gpu-blocklist / WebGL flags) - with the trade-off of degraded rendering performance and broken WebGL/WebGPU sites - and restricting users to trusted sites since exploitation requires loading attacker-controlled HTML. These are stopgaps only; the update is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics engine that translates OpenGL ES / WebGL calls made by web content into the host platform's native graphics API - on macOS this is Metal (historically OpenGL). Because ANGLE processes attacker-influenced GPU commands sourced from WebGL/WebGPU content, an 'inappropriate implementation' bug in this layer can allow rendered web content to violate the boundaries the browser relies on, here manifesting as a sandbox escape. No CWE was assigned in the source data, but the 'inappropriate implementation' phrasing and sandbox-escape impact point to a logic/security-boundary flaw in the graphics command handling rather than a classic memory-corruption class, though Chrome does not disclose exact root cause pre-patch. The affected component is confined to the macOS build per the CPE (cpe:2.3:a:google:chrome) and the description's explicit 'on Mac' qualifier.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs only a user visit (UI:R, PR:N, AC:L); sandbox escape crosses the security boundary (S:C) yielding full host C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
A critical privilege escalation flaw in Chrome's graphics rendering on macOS exposes any employee browsing the web to complete device compromise from a single malicious webpage. The attack requires no unusual user action beyond normal browsing, putting hundreds or thousands of endpoint devices at risk depending on macOS adoption. Affected organizations must prioritize patching to prevent potential data theft and lateral movement within corporate networks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB