EUVD-2026-50614
GHSA-w27c-274j-76rc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure macOS user to malicious site
-
DeliveryCompromise sandboxed renderer via prior bug
-
ExploitServe crafted HTML to Crypto component
-
ExecutionTrigger inappropriate implementation flaw
-
PersistEscape renderer sandbox (scope change)
-
ImpactGain higher-privilege host context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is a chained, second-stage sandbox escape, not a standalone remote bug, and that precondition is the single biggest limiting factor. The target must be running Google Chrome on macOS at a version below 151.0.7922.72, and the victim must load attacker-controlled content (UI:R - a crafted HTML page must be rendered). It does not apply to non-Mac builds per the description, and it cannot be used on its own without a prior renderer exploit, which is why Google rates it Medium despite the 9.6 CVSS. |
| Impact | Signals conflict and must be weighed rather than taken at face value. The CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) looks critical, but it scores the escape in isolation and ignores the explicit precondition in the description: the attacker must have ALREADY compromised the renderer process. That prerequisite is the reason Google itself rates the Chromium severity only Medium. EPSS agrees with the lower real-world urgency at 0.18% (8th percentile), and there is no KEV listing and no public exploit identified at time of analysis. Net: this is a genuine defense-in-depth weakness that matters as the second link in an exploit chain, not a standalone remote-code-execution bug, and it should be patched on Chrome's normal auto-update cadence rather than treated as an emergency. Note the CVSS PR:N/UI:R does not capture the renderer-compromise dependency - verify chaining assumptions against Google's advisory before ranking priority. |
| Exploit ScenarioDerived | An attacker first lands a separate renderer-level bug by luring a macOS Chrome user to a malicious site, gaining code execution inside the sandboxed renderer. They then serve crafted HTML that triggers the Crypto implementation flaw to escape the sandbox and reach higher-privilege browser/host context. No public exploit is identified at time of analysis, and the network vector with required user interaction (visiting the page) means delivery is easy but the escape depends on already holding the renderer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sandbox escape in Google Chrome for macOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page, escalating a contained renderer foothold toward the host. The flaw sits in Chrome's Crypto component and is a second-stage bug that must be chained with an initial renderer compromise. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and Google rates the Chromium security severity as Medium despite the high CVSS.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 - update the macOS Stable channel to that build or later (Chrome menu > About Google Chrome forces the update check and applies the fix on relaunch). In managed fleets, push the update via MDM/Google Admin console and force a browser restart so the staged update takes effect, since the fix is inert until relaunch. There is no separate workaround for a sandbox-escape defect; the meaningful compensating control is to reduce renderer-compromise exposure that this bug chains from - keep Chrome fully updated so the initial renderer bug is closed, and consider enabling stricter site isolation and enterprise policies that limit untrusted content, accepting minor compatibility friction. Reference: Google Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html) and Chromium issue 520516655.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is classed under CWE-693 (Protection Mechanism Failure), meaning a security control - here the Chrome renderer sandbox that isolates untrusted web content from the browser and OS - is implemented in a way that can be bypassed rather than a memory-corruption primitive per se. The affected surface is Chrome's Crypto implementation on the macOS platform build (cpe:2.3:a:google:chrome:*). Chrome's multi-process architecture confines rendering of web pages to a low-privilege renderer; a sandbox escape like this abuses inappropriate implementation to cross that trust boundary from renderer into a higher-privilege context, which is why the CVSS scope is marked Changed (S:C).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered via crafted page (AV:N, UI:R) but requires chaining a prior renderer compromise, raising complexity to AC:H; sandbox escape crosses trust boundary (S:C) with full host impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Chrome for macOS versions prior to 151.0.7922.72 contain a critical sandbox escape (CVE-2026-17865) allowing renderer-compromised processes to escalate to full device control. This affects all macOS users running vulnerable Chrome versions. Although no public exploit identified at time of analysis, the vulnerability's severity necessitates immediate patching to prevent potential device compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB