EUVD-2026-35216
GHSA-4m7c-c75j-4g7g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via prior bug
-
DeliveryLure user to crafted HTML page
-
ExploitDeliver malicious media payload
-
ExecutionTrigger out-of-bounds read/write in Media
-
PersistExecute arbitrary code in sandbox
-
ImpactChain with sandbox escape for host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have already compromised the Chrome renderer process on macOS (an explicit precondition in Google's description), the victim must be running a vulnerable Chrome build below 149.0.7827.103 on macOS specifically, and user interaction is needed to load a crafted HTML page containing the malicious media payload. The vulnerability is not directly exploitable from a clean browser state - it is a renderer-resident memory corruption that must be reached after another bug establishes code execution or memory primitives inside the renderer, which is why CVSS marks AC:H. Non-macOS Chrome installations and any browser already updated to 149.0.7827.103 or later are out of scope. |
| Impact | CVSS 7.5 (High) with vector AV:N/AC:H/PR:N/UI:R reflects meaningful real-world friction: the attack is network-reachable but requires high complexity, user interaction (visiting a crafted page), and - critically per the description - prior compromise of the renderer process, which the CVSS PR:N field arguably understates. SSVC corroborates lower urgency with Exploitation: none and Automatable: no, though Technical Impact is total within the sandbox boundary. No KEV listing and no public POC have been identified, and EPSS data was not provided. Net assessment: this is a chain-link bug - high impact in context of a full exploit chain but low standalone risk - and should be patched on the normal Chrome update cadence rather than treated as an emergency. |
| Exploit ScenarioDerived | An attacker who has already chained an initial renderer-process compromise (for example via a separate JavaScript engine bug) directs the victim browser to a crafted HTML page containing malicious media content that triggers the out-of-bounds read/write in the Media component, achieving arbitrary code execution within the sandboxed renderer. This bug would typically be paired with a sandbox escape to fully exfiltrate data or pivot onto the host. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Sandbox-confined arbitrary code execution in Google Chrome on macOS versions prior to 149.0.7827.103 stems from an out-of-bounds read and write in the Media component, exploitable by a remote attacker who has already compromised the renderer process and lures a user to a crafted HTML page. Google rates the Chromium severity as High and has released a patched stable channel update; no public exploit identified at time of analysis, and SSVC reports no observed exploitation.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - update via the stable channel as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, then restart the browser to activate the new build. For managed fleets, push the update via MDM or Chrome Browser Cloud Management and verify the version via chrome://version. As an interim compensating control prior to patching, restrict browsing to trusted sites and consider enabling Site Isolation strict mode (already default) and disabling unnecessary media features - though disabling media would break legitimate video/audio playback and is rarely tolerable. Administrators should also patch any downstream Chromium-based browsers once their vendors ship the corresponding fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's Media subsystem, which handles audio/video decoding, MediaStream, and related rendering pipelines inside the renderer process on macOS. CWE-125 (Out-of-bounds Read), combined with the description's mention of out-of-bounds write, indicates a memory boundary checking failure in media buffer handling - likely in parsing or processing crafted media content embedded in HTML. Because the bug lives in the renderer sandbox, exploitation yields code execution constrained by Chrome's macOS sandbox, but combined with a prior renderer compromise it forms a link in a multi-stage exploit chain (typically paired with a sandbox escape to reach full system compromise).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read and write in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on macOS prior to version 149.0.7827.103 contains a vulnerability that could allow attackers to execute code and compromise employee systems if users visit a malicious webpage. This affects all macOS-using employees and requires immediate browser updates to prevent potential unauthorized access to systems and sensitive data.
Apply vendor patch: Deploy Chrome 149.0.7827.103 or later to all affected macOS systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-125 – Out-of-bounds Read
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB