EUVD-2026-35255
GHSA-74g6-5mjw-f8x6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure target to attacker-controlled site
-
DeliveryExploit separate renderer RCE bug
-
ExploitDeliver crafted HTML media payload
-
ExecutionTrigger integer overflow in Media component
-
PersistEscape Chrome sandbox to browser process
-
ImpactExecute code with broader macOS privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Server-side parameter enforcement
|
| Exploitation Conditions | Attacker must already have code execution inside the Chrome renderer process on macOS (this bug alone is not an initial-access primitive - it is a sandbox-escape link in a chain), the target must be running Chrome on macOS at a version below 149.0.7827.103, and the user must interact by loading a crafted HTML page that exercises the vulnerable Media code path (UI:R in the CVSS vector). Limiting factors: the bug does not affect Chrome on Windows or Linux per the description; AC:H reflects non-trivial conditions to reliably trigger the integer overflow and convert it into a sandbox escape; and the prerequisite renderer compromise typically requires burning a second 0-day or N-day, which is why this class of bug is most relevant to targeted-attack threat models rather than commodity malware. |
| Impact | Real-world risk is moderate rather than urgent. CVSS 8.3 is elevated mainly because of Scope:Changed (sandbox escape) and High impact on confidentiality, integrity, and availability, but AC:H and UI:R meaningfully constrain exploitation: the attacker must already control the renderer (typically via a separate RCE bug) AND get the victim to load attacker-controlled content. There is no CISA KEV listing, no EPSS data provided, and no public exploit identified at time of analysis, so this is best treated as a sandbox-escape primitive valuable in a chain rather than a standalone mass-exploitation threat. The Mac-only scope further narrows the population at risk; defenders prioritizing patching for high-value macOS endpoints (executives, developers, researchers) should treat this seriously even though commodity exploitation is unlikely. |
| Exploit ScenarioDerived | An attacker first lands a separate renderer-process RCE (for example via a V8 type-confusion bug delivered through a malvertising network) on a macOS user running pre-149.0.7827.103 Chrome, then loads a second crafted HTML/media payload that triggers the integer overflow in the Media component to escape the renderer sandbox and execute code in a more privileged Chrome process. No public exploit identified at time of analysis, but Chrome sandbox-escape primitives are routinely chained by commercial spyware vendors, so a weaponized chain against high-value macOS targets is plausible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Sandbox escape in Google Chrome on macOS prior to version 149.0.7827.103 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers an integer overflow in the Media component. Google rates the Chromium severity as High, and no public exploit has been identified at time of analysis. Because exploitation requires chaining with a separate renderer compromise plus user interaction (visiting a malicious page), the attack complexity is High despite the network attack vector.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 for macOS - upgrade Chrome Stable on all Mac endpoints to 149.0.7827.103 or later via the Chrome Releases stable-channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html), and force-restart the browser so the new binary is actually loaded (a common gap, since Chrome auto-downloads but does not auto-relaunch). For Chromium-derived browsers on macOS (Edge, Brave, Opera, Vivaldi), apply the corresponding downstream release that incorporates the Chromium fix. As a temporary compensating control where immediate patching is not possible, deploy MDM policy to disable media autoplay and consider blocking untrusted sites via SafeBrowsing/enterprise URL filtering to reduce drive-by exposure; note that fully disabling Chrome's media stack is not practical, and these controls only reduce - not eliminate - the chance of reaching the vulnerable code path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's Media subsystem, which handles audio/video decoding and playback pipelines that operate across the renderer/browser process boundary. CWE-472 (External Control of Assumed-Immutable Web Parameter) combined with the 'integer overflow' wording in the description and the 'Buffer Overflow' tag indicates that a size or offset value crossing the IPC boundary from the renderer is not properly validated by a more-privileged process, allowing arithmetic wraparound that leads to out-of-bounds memory access or undersized allocations. Because Media code runs partly in the GPU/browser process on macOS, a wraparound there lets a malicious renderer corrupt memory outside its sandbox. The Scope:Changed CVSS attribute reflects exactly this cross-boundary escape from the sandboxed renderer into a more privileged Chrome process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on macOS versions below 149.0.7827.103 contain a sandbox escape vulnerability that allows attackers who have compromised the browser's renderer process to execute arbitrary code with browser privileges. Affected users face risk of malware installation and data exfiltration if they visit a malicious webpage after initial renderer compromise. All macOS users running Chrome should prioritize updates to patch this high-severity flaw.
Apply vendor patch: Google Chrome 149.0.7827.103 for macOS
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB