EUVD-2026-65763
GHSA-pr6f-vr87-8x7h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description explicitly states execution outside the Chrome sandbox, indicating scope change (S:C); all other metrics align with network-delivered, user-triggered, unauthenticated exploitation.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Memory corruption in Chrome's Tint graphics library on macOS allows remote attackers to potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. All Google Chrome versions prior to 152.0.7977.65 on Mac are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation is limited to Google Chrome on macOS - other platforms (Windows, Linux, Android, iOS) and other Chromium-based browsers are not confirmed affected by this specific issue. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects straightforward network-reachable exploitation requiring only that the victim visit a malicious page - no authentication and low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a webpage containing crafted HTML and WebGPU shader content designed to trigger memory corruption in Chrome's Tint library during page rendering. When a macOS user visits the page - through a phishing link, malvertising, or a compromised site - the Tint component processes the malicious content, corruption occurs in memory, and the attacker achieves arbitrary code execution that breaks out of Chrome's renderer sandbox and runs at the OS user's privilege level. … |
| Remediation | Vendor-released patch: Chrome 152.0.7977.65. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all macOS systems running Google Chrome and send urgent patch communications to users, clearly stating that versions prior to 152.0.7977.65 contain a sandbox-escape vulnerability requiring immediate action. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today