EUVD-2026-50642
GHSA-h58v-fw4c-hx28
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Network delivery via crafted page (AV:N), high complexity due to required prior renderer compromise (AC:H), scope change confirmed by Updater privilege escalation beyond sandbox (S:C), limited post-escape impact (C:L/I:L/A:L) consistent with Updater's constrained role.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome's Updater component on macOS (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to break out of Chrome's security boundary via a crafted HTML page. The CVSS scope-change metric (S:C) confirms the exploit elevates impact beyond the sandboxed renderer into a higher-privilege Updater context. No public exploit code has been identified and EPSS stands at 0.18% (8th percentile), reflecting the high prerequisite barrier of requiring prior renderer compromise; however, the Mac-specific Updater's elevated privilege position makes this a meaningful chained-exploit risk in targeted macOS campaigns.
Technical ContextAI
Chrome's multi-process architecture isolates web content in a sandboxed renderer process. On macOS, Chrome's Updater runs with elevated privileges outside that sandbox and communicates with renderer processes via inter-process messaging. CWE-20 (Improper Input Validation) in the Updater means it fails to adequately validate data received from the renderer, which an attacker already controlling the renderer can craft maliciously to manipulate Updater behaviour and escape the sandbox boundary. The CVSS S:C (scope changed) metric confirms impact extends beyond the sandboxed component into the Updater's more-privileged execution context. Affected CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on macOS only, all versions prior to 151.0.7922.72.
RemediationAI
Update Google Chrome on macOS to version 151.0.7922.72 or later, which contains the vendor-released patch per the Chrome Releases blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default, but administrators managing enterprise macOS fleets should verify patch delivery via fleet management tooling and confirm the installed version is 151.0.7922.72 or higher. If patching is delayed, reducing user exposure to untrusted web content lowers the probability of renderer compromise - the mandatory precondition for this flaw - though this is not a direct mitigation of the Updater vulnerability itself. No documented workarounds neutralise the Updater input validation flaw independently of the patch.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today