EUVD-2026-50838
GHSA-w8rv-f4mw-5237
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable via a malicious page (AV:N, UI:R, PR:N); AC:H because winning a Skia race is timing-dependent and non-deterministic; S:U since code stays inside the sandbox.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandboxed remote code execution in Google Chrome for macOS before 151.0.7922.72 stems from a race condition in the Skia graphics library that a crafted HTML page can trigger to run arbitrary code within the renderer sandbox. Google (Chrome team) reported the flaw and rated it High severity; a stable-channel patch is available. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to load attacker-controlled HTML in Google Chrome on macOS prior to 151.0.7922.72 (user interaction is mandatory per UI:R - the attacker cannot trigger it without the user visiting or rendering the malicious page). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects network-reachable, unauthenticated exploitation requiring user interaction (visiting a malicious page) with high impact but no scope change - consistent with code execution confined to the sandbox. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts or injects a crafted HTML page that drives Skia into the vulnerable concurrent code path; a macOS user who visits the page triggers the race and the attacker gains arbitrary code execution inside the Chrome renderer sandbox. No public exploit is identified at time of analysis, and winning the race plus the sandbox boundary raises the bar for reliable weaponization; a full compromise would additionally require chaining a separate sandbox-escape bug. |
| Remediation | Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the stable channel (Chrome Releases advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome applies fixes only after relaunch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all macOS systems running Chrome versions prior to 151.0.7922.72 through endpoint management or browser telemetry. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today