EUVD-2026-50837
GHSA-37xg-v5ff-wmh2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise Chrome renderer via prior bug
-
DeliveryServe crafted HTML triggering downloads
-
ExploitRace Downloads component (CWE-362)
-
ExecutionManipulate shared state mid-operation
-
PersistEscape sandbox into browser process
-
ImpactExecute code with browser privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process (this is a sandbox-escape/second-stage bug, not an initial entry point) and the victim to be running Chrome on macOS at a version below 151.0.7922.72. The vulnerable code path is the Downloads component, so the attacker must be able to drive download operations from the crafted HTML page and win a race-condition timing window (CWE-362), which is non-deterministic and may require many attempts. User interaction is required (UI:R) - the victim must load the malicious page. Limiting factors: the mandatory prior renderer compromise, the macOS-specific scope, the timing-dependent nature of the race, and the need for the target to be unpatched. |
| Impact | Signals are mixed and should be read together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) reflects the full drive-by chain and scope change, but the description makes clear this bug is only the second stage: it requires a renderer that is ALREADY compromised, so it is not independently network-exploitable with no prior foothold - a limiting factor the raw 9.6 does not convey. Corroborating the lower real-world urgency, EPSS is only 0.23% (14th percentile), the bug is NOT in CISA KEV, and CISA SSVC records Exploitation: none and Automatable: no while acknowledging Technical Impact: total. The combination indicates a serious but not currently exploited defense-in-depth bug: valuable as part of a full exploit chain, but not a widespread mass-exploitation threat today. Note the discrepancy to verify: PR:N in the CVSS vector versus a description that plainly requires renderer compromise. |
| Exploit ScenarioDerived | An attacker first gains code execution in Chrome's renderer via a separate bug, then serves a crafted HTML page that repeatedly triggers download operations to win a timing race in the Downloads component. By manipulating shared state at the right moment, the renderer-level code escapes the sandbox and gains code execution in the more privileged browser process on the victim's Mac. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a race condition in the Downloads component through a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope-changing total impact, it is patched in the July 2026 Stable channel update. There is no public exploit identified at time of analysis, EPSS is low at 0.23%, and CISA SSVC records exploitation as 'none'.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Stable channel (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome staged updates only take effect after relaunch. In managed fleets, push the update through your MDM/enterprise policy and confirm the running version rather than the installed version. There is no supported feature-level workaround for this internal race condition; because exploitation presupposes a compromised renderer, the practical compensating control until patching is to reduce renderer-compromise exposure - keep the rest of Chrome fully patched, enforce Site Isolation (default), and limit exposure to untrusted web content - accepting that these reduce but do not eliminate the risk of the underlying sandbox-escape bug.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-362 concurrent execution / race condition (TOCTOU-class) in Chrome's Downloads subsystem, which coordinates fetching, staging, and writing files across multiple threads and IPC boundaries between the renderer and the privileged browser process. A malicious HTML page can drive the renderer to interleave download operations such that shared state is manipulated between a check and its use, letting attacker-controlled renderer code influence a privileged operation and cross the sandbox boundary. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*; the macOS-specific framing suggests the race is sensitive to platform download/file-handling behavior on that OS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AV:N and UI:R for the drive-by page; AC:H because success needs a pre-compromised renderer plus winning a non-deterministic race; S:C with C/I/A:H reflects a full sandbox escape into the browser process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on macOS versions prior to 151.0.7922.72 contains a critical vulnerability that could enable attackers to escape the browser sandbox and gain unrestricted system access, creating significant risk of data theft and system compromise for all affected macOS users. Immediate patching to version 151.0.7922.72 is essential to mitigate this risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB