What is the CVSS score of CVE-2026-18015?

CVE-2026-18015 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-18015?

Google Chrome on macOS versions prior to 151.0.7922.72 contain a sandbox escape vulnerability in the Tint component that could allow remote attackers to execute arbitrary code on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-18015?

Within 24 hours, inventory all macOS devices running Chrome through your endpoint management platform and send urgent notification to users directing them to update to Chrome 151.0.7922.72 or later; verify whether your organization has managed Chrome deployments and confirm current version status. Within 7 days, deploy Chrome 151.0.7922.72 or later via Mobile Device Management, group policy, or equivalent mechanism, prioritizing administrative and high-risk user populations; document deployment metrics and send follow-up communication to non-compliant users. Within 30 days, complete full inventory validation confirming 100% of macOS Chrome installations are at 151.0.7922.72 or later, and establish automated update mechanisms to prevent similar critical gaps in future security releases.

Google Chrome CVE-2026-18015

EUVD-2026-50941 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-jj82-hh8h-mw7q

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote crafted page needs no auth (PR:N) but requires a visit (UI:R) and realistic chaining for a sandbox escape (AC:H); scope changes (S:C) with full impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:31 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

CRITICAL 9.6

DescriptionCVE.org

Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome on macOS (versions prior to 151.0.7922.72) stems from an inappropriate implementation in the Tint component and lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rated the Chromium severity as Low, though the reported CVSS is 9.6; there is no public exploit identified at time of analysis and the EPSS score is only 0.16% (6th percentile), pointing to low near-term exploitation likelihood. The flaw is Mac-specific and requires user interaction (visiting a malicious page).

Technical ContextAI

Tint is Chromium's WGSL-to-backend shader translation library used by the WebGPU/Dawn graphics stack to compile GPU shader programs supplied by web pages. An inappropriate implementation here means a protection-mechanism or validation step in the shader compilation/translation path did not behave as intended, which is why the issue maps to CWE-693 (Protection Mechanism Failure) rather than a direct memory-corruption class. Because WebGPU exposes lower-level GPU access to untrusted web content, a logic gap in Tint on the macOS backend can be leveraged from the renderer to weaken or bypass the sandbox boundary. The affected product per CPE is cpe:2.3:a:google:chrome:*, specifically the macOS build.

RemediationAI

Vendor-released patch: update Google Chrome on macOS to version 151.0.7922.72 or later via the Stable channel, then restart the browser to load the new binary (Chrome auto-updates but the update only takes effect on relaunch). Details are in the Chrome release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If patching must be deferred, a targeted compensating control is to disable WebGPU (navigate to chrome://flags and turn off the WebGPU/unsafe-WebGPU flags, or deploy the enterprise policy to disable it), which removes access to the Tint shader path at the cost of breaking sites that rely on WebGPU-accelerated graphics/compute; because exploitation depends on user interaction, enforcing Safe Browsing and cautioning users against untrusted pages further reduces exposure until the update is applied.