EUVD-2026-50838
GHSA-w8rv-f4mw-5237
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
DeliveryPage drives Skia concurrent rendering path
-
ExploitWin race condition (CWE-362)
-
ExecutionCorrupt memory in renderer
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML in Google Chrome on macOS prior to 151.0.7922.72 (user interaction is mandatory per UI:R - the attacker cannot trigger it without the user visiting or rendering the malicious page). It further depends on winning a timing-sensitive race in Skia, which limits reliability, and the resulting code execution is confined to the renderer sandbox (S:U, no scope change), so it does not by itself yield host compromise without an additional sandbox-escape primitive. The flaw is platform-specific to macOS. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects network-reachable, unauthenticated exploitation requiring user interaction (visiting a malicious page) with high impact but no scope change - consistent with code execution confined to the sandbox. Several signals temper the raw score: EPSS is low at 0.28% (21st percentile), there is no public exploit identified at time of analysis, and CISA SSVC records Exploitation: none and Automatable: no, though Technical Impact is total. One point of tension worth flagging: the vector uses AC:L, yet race conditions (CWE-362) are frequently non-deterministic and hard to win reliably, which in practice can raise attack complexity - treat AC:L as the vendor's rating rather than a guarantee of trivial reproducibility. Overall this is a standard-priority browser patch: real and high-impact if chained, but no evidence of active or imminent mass exploitation. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page that drives Skia into the vulnerable concurrent code path; a macOS user who visits the page triggers the race and the attacker gains arbitrary code execution inside the Chrome renderer sandbox. No public exploit is identified at time of analysis, and winning the race plus the sandbox boundary raises the bar for reliable weaponization; a full compromise would additionally require chaining a separate sandbox-escape bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandboxed remote code execution in Google Chrome for macOS before 151.0.7922.72 stems from a race condition in the Skia graphics library that a crafted HTML page can trigger to run arbitrary code within the renderer sandbox. Google (Chrome team) reported the flaw and rated it High severity; a stable-channel patch is available. There is no public exploit identified and EPSS is low (0.28%, 21st percentile), and CISA SSVC currently marks exploitation status as none.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the stable channel (Chrome Releases advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome applies fixes only after relaunch. In managed fleets, push the update through MDM/enterprise policy and verify the running build via chrome://settings/help. Because the vulnerability requires loading attacker-controlled web content, an interim compensating control is to restrict browsing to trusted sites and enforce Chrome's Site Isolation and sandbox (both default-on; do not disable them) until the update is deployed; note that these controls reduce but do not eliminate exposure, so patching remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Skia is Chromium's 2D graphics rasterization engine used to render web content (Canvas, CSS, SVG, and general page compositing). The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e., a race condition), where concurrently executing Skia code paths access shared state without correct synchronization, producing a memory-safety corruption (such as a use-after-free or type confusion window) that is exploitable for code execution. The affected component is the browser's rendering pipeline on the macOS platform specifically; per the description the resulting code execution occurs inside the renderer sandbox rather than as a full sandbox escape. The affected product per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable via a malicious page (AV:N, UI:R, PR:N); AC:H because winning a Skia race is timing-dependent and non-deterministic; S:U since code stays inside the sandbox.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on macOS versions before 151.0.7922.72 contains a high-severity remote code execution vulnerability in the Skia graphics library that can be triggered through crafted web pages. The vulnerability enables code execution within the browser renderer sandbox, potentially compromising user sessions, credentials, and sensitive data accessible to affected systems. Organizations with macOS-based workforces must deploy the patch immediately to eliminate this active security risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-362 – Race Condition
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB