Google Chrome EUVD-2026-61230

Exploitation requires the victim to be running Google Chrome on macOS at a version below 151.0.7922.169 and to open a crafted HTML page - user interaction (UI:R) is mandatory, so the attacker must lure the target to attacker-controlled content rather than exploiting passively. No authentication or prior privileges are needed (PR:N), and the attack works over the network against a default Chrome install; the specific trigger is malformed media content handled by Chrome's Media component. Limiting factors: the flaw is scoped to the macOS platform only, the browser must be unpatched, and the single required click is the main gate on mass exploitation.

This is a genuine high priority, not an inflated score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) indicates network reachability, low complexity, no privileges, only a single user click, and a scope change with total confidentiality/integrity/availability loss - consistent with a browser sandbox escape. No EPSS score, SSVC decision, or CISA KEV entry was provided, so probabilistic exploitation and automatability cannot be quantified from the input, and there is no public exploit identified at time of analysis. The absence of KEV/POC data means active exploitation is NOT confirmed; however, media-component sandbox escapes in Chrome are historically attractive targets and Google's own security team reported this (chrome-cve-admin@google.com), so defenders should treat patching as urgent despite the missing EPSS/KEV signals. Note the platform scope is explicitly macOS only per the description.

An attacker hosts a malicious web page containing crafted media content and lures a macOS Chrome user to visit it via a phishing link, malvertising, or a compromised site. When Chrome's Media component processes the crafted content, the improper implementation is triggered and the attacker executes arbitrary code outside the renderer sandbox, gaining code execution in the user's context on the Mac. No public exploit code is identified at time of analysis, and success requires the victim to open the page (UI:R).