EUVD-2026-50696
GHSA-8pv3-6rr2-f4r8
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
AC:H reflects mandatory renderer pre-compromise; S:C captures the sandbox escape; C/I/A:L reflects GPU process impact before further chaining.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Use after free in GPU in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Use-after-free in the GPU process on macOS enables sandbox escape in Google Chrome versions prior to 151.0.7922.72, but only when an attacker has already achieved renderer process compromise. This is a second-stage exploit primitive - it extends an existing renderer compromise across the sandbox boundary into the GPU process, potentially allowing arbitrary code execution outside Chrome's sandbox on macOS. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; however, sandbox escapes are a critical capability for attackers chaining browser exploit kits.
Technical ContextAI
CWE-416 (Use After Free) in Chrome's GPU process on macOS arises when a dangling pointer to a freed GPU memory object is dereferenced after deallocation. Chrome's multi-process architecture isolates web content in a renderer sandbox, with the GPU process handling graphics acceleration as a separate privileged process that renderer processes communicate with via IPC. By sending crafted IPC messages or GPU commands from a compromised renderer, an attacker can trigger the UAF condition in the GPU process, which runs with higher trust than the renderer. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome builds prior to 151.0.7922.72, but the advisory explicitly scopes the platform to Mac. GPU process UAF bugs in Chromium are a well-documented class that can yield arbitrary read/write primitives within the GPU process heap.
RemediationAI
Update Google Chrome on macOS to version 151.0.7922.72 or later, which contains the vendor-released patch per the stable channel advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically updates automatically, but users should verify via Chrome menu > Help > About Google Chrome. Because exploitation requires a pre-existing renderer compromise, organizations running Chrome in managed environments can enforce Site Isolation (--site-per-process, enabled by default in modern Chrome) and ensure renderer sandboxing is not disabled via enterprise policy - disabling these would significantly lower the bar. There are no known effective workarounds short of patching; blocking GPU acceleration via --disable-gpu would remove the vulnerable surface but breaks rendering for many applications. Prioritize patching macOS Chrome endpoints within standard patch cycles; this is not an emergency zero-day given the low EPSS and absence of active exploitation evidence.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today