EUVD-2026-40784
GHSA-r7gr-w5gq-fjxx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Requires a pre-compromised renderer (PR:H) and reliable chaining of a separate bug (AC:H); success crosses the sandbox boundary (S:C) yielding high host impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Sandbox escape in Google Chrome on macOS prior to 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the WebAppInstalls component. Chromium rated the underlying issue Low severity even though the CVSS base score is 9.6, and there is no public exploit identified at time of analysis; EPSS is 0.17% (7th percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process on the target - this is a sandbox-escape stage, not an initial-access bug - and to deliver a crafted HTML page through the WebAppInstalls code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply and must be reconciled. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first compromises Chrome's sandboxed renderer on a macOS target (for example by chaining a separate renderer memory-safety bug from a malicious web page), then serves a crafted HTML page that abuses the WebAppInstalls component to escape the sandbox and gain access to the more privileged browser process. No public POC is currently identified, and user interaction (visiting the attacker's page) is required per the CVSS UI:R metric. |
| Remediation | Vendor-released patch: Google Chrome 150.0.7871.47 for macOS. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all macOS systems running Chrome versions prior to 150.0.7871.47 and prepare a test environment to validate patch deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today