EUVD-2026-50605
GHSA-rw7f-3qv6-gp4q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
DeliveryLeverage existing renderer compromise
-
ExploitAbuse Network component implementation flaw
-
ExecutionEscape browser sandbox
-
ImpactGain host-level access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires that the attacker has already compromised the Chrome renderer process - this is the explicit, mandatory precondition stated in the CVE ('a remote attacker who had compromised the renderer process'). It further requires the victim to load a crafted HTML page (user interaction, UI:R) in Chrome on macOS at a version below 151.0.7922.72; non-Mac platforms and patched builds are not in scope per the description. The key limiting factor is that this is not a standalone exploit: without a separate renderer bug to establish the foothold, the sandbox escape cannot be triggered, which is why Chromium rated it Medium despite the Critical CVSS. |
| Impact | Signals conflict and must be weighed carefully. The supplied CVSS 3.1 vector scores 9.6 (Critical) with AV:N/AC:L/PR:N/UI:R and scope change, but the description explicitly requires that the attacker 'had compromised the renderer process' first - a substantial precondition that Chromium's own team reflected by rating this only Medium. The high CVSS treats the renderer compromise as out-of-scope chaining rather than a privilege requirement, which inflates the score relative to real-world standalone risk. EPSS is low (0.18%, 8th percentile), there is no KEV listing and no public exploit identified, so this is not a widely-weaponized threat today. Realistically this is a second-stage primitive: dangerous as the escape link in an exploit chain, but not independently exploitable without a working renderer bug. Note the tag 'Information Disclosure' is inconsistent with a sandbox-escape description - verify with the vendor advisory before relying on impact framing. |
| Exploit ScenarioDerived | An attacker who already has a working renderer exploit lures a macOS user to a crafted HTML page; once the renderer is compromised, the crafted content abuses the Network component's inappropriate implementation to break out of the sandbox and gain broader access on the host. No public exploit is identified at time of analysis, and the attack requires the attacker to first hold a renderer-compromise primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sandbox escape in Google Chrome on macOS before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a contained renderer exploit into broader access on the host. The flaw stems from an inappropriate implementation in Chrome's Network component and is fixed in the stable channel update. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and Chromium rated the underlying severity Medium despite the NVD-style CVSS 9.6.
RemediationAI
Vendor-released patch: Google Chrome 151.0.7922.72 for macOS. Update Chrome to 151.0.7922.72 or later via the built-in updater (chrome://settings/help) and relaunch the browser to apply; in managed fleets, push the update through MDM/enterprise policy and force a restart since Chrome will not complete the update until relaunched. Reference the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue at https://issues.chromium.org/issues/519991751. Because this is a sandbox escape that requires a prior renderer compromise, defense-in-depth against the initial foothold also helps: keep all Chrome components current, and where feasible enforce Site Isolation and restrict untrusted browsing, though these do not substitute for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Chrome's multi-process security architecture on macOS, specifically the boundary between the sandboxed renderer process and the more-privileged browser/network layer. Chrome isolates web content in a locked-down renderer; a sandbox escape defeats that containment. The CWE-693 (Protection Mechanism Failure) classification indicates the sandbox protection mechanism itself was bypassable due to an 'inappropriate implementation in Network' rather than a classic memory-safety bug. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers Chrome generically, but the description narrows the defect to the macOS build prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H because a prior renderer compromise must be chained; UI:R for visiting the page; S:C and high C/I/A reflect escaping the sandbox into the more-privileged host context.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on macOS contains a critical vulnerability that could result in complete system compromise. No public exploit identified at time of analysis, and current attack likelihood remains minimal, but potential impact severity warrants prompt patch deployment. Organizations should prioritize updating Chrome to version 151.0.7922.72 on all macOS systems within 30 days.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB