EUVD-2026-50876
GHSA-whvp-r9r4-24v4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious file for target
-
DeliveryLure macOS Chrome user to download
-
ExploitSafe Browsing mishandles file
-
ExecutionCross privilege/trust boundary
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim run Google Chrome on macOS at a version earlier than 151.0.7922.72 and actively interact with attacker-supplied content - specifically downloading or opening a malicious file that is handled by the Safe Browsing component (CVSS UI:R confirms required user interaction). Limiting factors: the flaw is platform-specific to macOS (Windows/Linux builds are not listed as affected), it depends on the user taking the file-open/download action rather than any drive-by trigger, and SSVC marks it Automatable: no, so mass-automated exploitation is unlikely. No authentication or pre-existing privileges are needed (PR:N), but the mandatory user interaction and single-platform scope meaningfully constrain realistic exploitation. |
| Impact | The signals conflict and should temper the raw score. The CVSS base of 8.8 (network vector, low complexity, no privileges, user interaction required, total C/I/A impact) reads as high priority, and SSVC agrees on Technical Impact: total. However, SSVC records Exploitation: none and Automatable: no, EPSS is a low 0.20% (10th percentile), the issue is NOT on CISA KEV, and Chromium itself assigned only 'Low' security severity - a notable divergence from the 8.8 NVD-style score. There is no public exploit identified at time of analysis. The gating factor is UI:R: the victim must actively open/download a malicious file, and exploitation is macOS-specific, which caps real-world spread. Net assessment: patch it as part of normal Chrome update hygiene, but this is a high-CVSS/low-real-risk profile rather than an emergency; the Chromium 'Low' rating and non-automatable SSVC suggest the practical exploitability is constrained. Note the discrepancy: NVD/CVSS labels this critical-adjacent while the vendor rates it Low - verify severity expectations against Google's advisory before prioritizing above other patches. |
| Exploit ScenarioDerived | An attacker hosts or emails a specially crafted malicious file and uses social engineering to get a macOS Chrome user (running a version before 151.0.7922.72) to download or open it. Because of the Safe Browsing implementation flaw, processing the file crosses a trust boundary and results in arbitrary code execution in the user's context. The attack requires that single user interaction (UI:R) but no authentication or elevated privileges; no public exploit is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome on macOS prior to 151.0.7922.72 stems from an inappropriate implementation in the Safe Browsing component, where a remote attacker can trigger arbitrary code execution by luring a victim into opening or downloading a malicious file. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) requires no privileges but does require user interaction, and Google has shipped a fixed Stable channel build. Despite the 8.8 CVSS, Chromium rated the underlying issue Low severity, EPSS is only 0.20% (10th percentile), and there is no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome on macOS to 151.0.7922.72 or later via Chrome's built-in updater (chrome://settings/help) and relaunch the browser to apply it, per Google's Stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the updated build through MDM/enterprise policy and force a relaunch to ensure the patched binary is active. As an interim compensating control before updating, advise users not to open or download untrusted files and, where policy allows, restrict downloads from untrusted sites; note this does not remove the flaw and reduces usability. Since Safe Browsing is the affected component, disabling it is counterproductive - it would remove other protections without reliably closing this path - so upgrading is strongly preferred over any toggle-based workaround.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's Safe Browsing subsystem - the Google service that inspects downloaded files and visited URLs against reputation lists to warn users of malware and phishing. An 'inappropriate implementation' here means the feature's file-handling logic behaves in a way that a malicious file can subvert to reach a code-execution path. The vulnerability is filed under CWE-269 (Improper Privilege Management), and the tags (RCE, Privilege Escalation) suggest the malicious file leverages a privilege/trust boundary weakness in how Safe Browsing processes it. The affected platform is specifically the macOS build of Chrome (CPE cpe:2.3:a:google:chrome), so the identical Windows/Linux binaries are not necessarily impacted the same way.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote malicious file needs one user action (UI:R) but no privileges (PR:N); Safe Browsing RCE yields full code execution, so C/I/A all High.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a malicious file. (Chromium security severity: Low)
Executive ViewAI
Google Chrome on macOS is vulnerable to remote code execution through a Safe Browsing component flaw (CVE-2026-17950, CVSS 8.8) when users download or open malicious files. While the vulnerability poses a serious risk to macOS-based workforces relying on Chrome, no public exploit identified at time of analysis, and practical risk is further mitigated by the requirement for user interaction and immediate availability of a vendor-released patch.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB