EUVD-2026-50719
GHSA-jg6f-wwpp-jhgg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExploit separate renderer vulnerability
-
DeliveryGain code execution in Chrome renderer sandbox
-
ExploitServe crafted media via malicious HTML page
-
ExecutionTrigger out-of-bounds read in Media component
-
PersistLeak cross-boundary memory
-
ImpactEscape renderer sandbox on macOS host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Two distinct prerequisites must both be satisfied: (1) the Chrome renderer process must already be compromised via a separate exploit - this is an explicit precondition stated in the CVE description ('remote attacker who had compromised the renderer process') and the primary factor behind AC:H; (2) the victim must interact with a crafted HTML page (UI:R) while using Chrome on macOS specifically. The vulnerability does not affect Chrome on Windows, Linux, Android, or iOS. No non-default Chrome configuration or special feature flag is required - standard media processing being active is sufficient once the renderer is already under attacker control. Exploitation is not automatable (SSVC: Automatable: no) due to the renderer-compromise prerequisite. CVSS PR:N indicates no attacker privilege is required for the network-delivery stage, but the renderer-compromise prerequisite is a substantial practical barrier to opportunistic use. |
| Impact | CVSS 5.8 with AC:H and S:C (scope change) reflects a technically demanding but high-consequence vulnerability class. The AC:H is driven by the prerequisite that the renderer must already be compromised - meaning this is a second-stage exploit in a chain, not a standalone initial access vector. EPSS at 0.21% (11th percentile) is very low, consistent with the SSVC assessment of Exploitation: none and Automatable: no. The vulnerability is not in CISA KEV. Despite the medium CVSS base score, sandbox escapes carry disproportionate strategic value in targeted attack chains against macOS users. Real-world risk is low for opportunistic broad exploitation but moderate-to-significant for targeted campaigns already leveraging a renderer exploit. The macOS-only platform restriction further limits exposed population. |
| Exploit ScenarioDerived | An attacker operating a malicious or compromised website first exploits a separate renderer-stage vulnerability to gain code execution within Chrome's sandboxed renderer process on a macOS victim. They then serve a crafted HTML page containing specially constructed media content that triggers the out-of-bounds read in Chrome's Media component, using the leaked memory to break out of the renderer sandbox and gain broader access to the macOS host system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.
RemediationAI
Vendor-released patch: 151.0.7922.72 for macOS. Update Google Chrome to version 151.0.7922.72 or later immediately on all macOS endpoints; Chrome's automatic update mechanism will apply this in most managed environments. The vendor advisory is at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control while patching is staged, ensure Chrome's built-in site isolation is active (verify via chrome://flags/#enable-site-per-process) to reduce renderer compromise risk that is a prerequisite for this vulnerability - disabling site isolation would increase exposure to the initial renderer stage. No specific workaround eliminates the OOB read itself without the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability (CWE-125, Out-of-bounds Read) resides in Chrome's Media subsystem, which handles decoding and processing of audio/video content embedded in web pages. Chrome's multi-process security architecture isolates web content in a sandboxed renderer process; a sandbox escape crosses from this constrained environment to the host OS, represented by S:C in the CVSS vector. Affected product CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the platform constraint of macOS. The OOB read allows reading memory beyond an allocated buffer boundary, which in a sandbox-escape context is typically used to leak memory layout data enabling further exploitation of the broader OS environment.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
AC:H reflects the mandatory renderer-compromise prerequisite; S:C captures sandbox escape; PR:N applies to the network delivery stage; C/I/A:L reflects partial impact post-escape.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Media in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Multiple Security Flaws
View all 80Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB