EUVD-2026-35203
GHSA-prmr-q74g-m753
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Race in Network in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the network process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome on macOS versions prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer/network process to break out of the browser sandbox via a race condition triggered by a crafted HTML page. Chromium rates the severity as High and a vendor patch is available, though no public exploit has been identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the target running Google Chrome on macOS at a version older than 149.0.7827.103, (2) the attacker already having compromised the Chrome Network process via a separate vulnerability (this CVE is a sandbox-escape primitive, not initial access), (3) the victim loading attacker-controlled HTML in that Chrome instance (UI:R), and (4) winning a race condition in the Network service (AC:H), which is non-deterministic. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H yields an 8.3 score reflecting network reach, scope change (sandbox escape), and full CIA impact, but tempered by High attack complexity (winning a race) and required user interaction (visiting a crafted page). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A targeted user on macOS visits a malicious or compromised website serving crafted HTML; an attacker who has chained a prior renderer/network-process RCE then races shared state in Chrome's Network service to escape the sandbox and execute code with the broader privileges of the browser process on the host. Because the bug requires both a pre-existing network-process compromise and winning a timing race, realistic use is in advanced multi-stage exploit chains (e.g., targeted spyware) rather than commodity drive-by attacks. |
| Remediation | Vendor-released patch: Google Chrome 149.0.7827.103 or later for macOS - upgrade via Chrome's built-in updater or by relaunching the browser, and verify the version under chrome://settings/help. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all macOS systems running Chrome versions prior to 149.0.7827.103 and assess deployment readiness. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today