EUVD-2026-74416
GHSA-4hj6-pw6p-5x4c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs only a victim visit (UI:R, PR:N); sandbox escape crosses a trust boundary (S:C) with code-execution impact, though Chromium's Medium rating suggests C/I/A:H may be optimistic.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox-escape remote code execution affects Google Chrome on macOS prior to 153.0.8010.36, where an improper quantity-validation flaw (CWE-1284) in Tint, the WebGPU/WGSL shader compiler in Chromium's Dawn graphics stack, lets a crafted HTML page break out of the renderer sandbox. A remote attacker who lures a victim to a malicious web page can potentially execute arbitrary code with the privileges of the browser process on the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to visit or be redirected to an attacker-controlled HTML page in a vulnerable Chrome build (UI:R - user interaction is the primary gating factor, no authentication needed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) models a full, unauthenticated, low-complexity network-reachable sandbox escape requiring only that a user open a page - a genuinely serious profile, and a sandbox escape is among the higher-value Chrome bug classes because it removes the browser's primary containment layer. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Google Chrome 153.0.8010.36 for macOS - upgrade to this stable-channel build or later, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all macOS endpoints running Chrome versions prior to 153.0.8010.36 through your endpoint management system and immediately enable automatic Chrome updates if not already configured; advise users to defer visiting untrusted websites until patched. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today