EUVD-2026-50899
GHSA-52cw-24q4-4ccc
Severity by source
Sources disagree (Low–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:L reflects local-only attack surface; PR:N because no application-level privileges are required beyond local machine access; UI:R as victim must open the crafted page; C:H for process memory exposure with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Information disclosure in the Views UI component of Google Chrome on macOS allows a local attacker to read potentially sensitive data from browser process memory by inducing a user to open a crafted HTML page on versions prior to 151.0.7922.72. The flaw is Mac-platform-specific, categorized by Chromium itself as Low severity, and carries no integrity or availability impact. No public exploit exists and no active exploitation has been identified; EPSS probability sits at 0.11% (2nd percentile) and CISA SSVC classifies exploitation as none.
Technical ContextAI
The vulnerability resides in Chrome's Views framework - the cross-platform but platform-backend-specific UI toolkit responsible for rendering browser interface elements. On macOS, the Views layer interfaces with native AppKit/Cocoa APIs, and an inappropriate implementation within this layer inadvertently exposes process memory contents when processing certain HTML content. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause class: the software does not adequately prevent sensitive data from being accessible to an actor that is not explicitly authorized to have that access. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions, but the description constrains the flaw to the Mac platform specifically, suggesting involvement of macOS-specific rendering paths, compositor layers, or memory management in the Views backend rather than cross-platform Chromium code.
RemediationAI
Update Google Chrome on macOS to version 151.0.7922.72 or later, which resolves this vulnerability per the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will deliver this fix automatically in most environments; administrators should verify managed endpoints have received the update via fleet management tooling. If immediate patching is not feasible, restricting physical and remote shell access to macOS systems by untrusted local users eliminates the attack surface, since the local attack vector (AV:L) is a hard prerequisite. Blocking access to untrusted external HTML content via proxy filtering reduces delivery risk, though this is a secondary mitigation with significant usability trade-offs. No feature-level workaround targeting the Views memory leak specifically has been documented by the vendor.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today