EUVD-2026-65763
GHSA-pr6f-vr87-8x7h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliverymacOS Chrome user visits malicious page via phishing or malvertising
-
ExploitBrowser parses page and invokes Tint for graphics/shader processing
-
ExecutionMemory corruption triggered in Tint component
-
PersistRenderer sandbox bypassed, arbitrary code executes at OS user level
-
ImpactAttacker achieves full user-context OS access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation is limited to Google Chrome on macOS - other platforms (Windows, Linux, Android, iOS) and other Chromium-based browsers are not confirmed affected by this specific issue. The victim must visit an attacker-controlled or attacker-compromised HTML page (UI:R), but no authentication, login, or special browser configuration is required beyond running a vulnerable Chrome version on macOS. No Chrome flags or experimental features need to be enabled; normal WebGPU-capable browser operation is sufficient. What limits exploitation: macOS-only scope reduces the target population, and the user-interaction requirement (victim must navigate to the malicious page) prevents fully automated mass exploitation without a delivery mechanism such as phishing or malvertising. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects straightforward network-reachable exploitation requiring only that the victim visit a malicious page - no authentication and low attack complexity. However, the provided CVSS marks scope as Unchanged (S:U), which conflicts with the description's explicit claim of code execution 'outside the sandbox.' Sandbox escape logically implies S:C and would raise the score to approximately 9.6; this discrepancy should be verified against the Chromium bug tracker. EPSS at 0.25% (16th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis, consistent with a freshly patched browser vulnerability. The absence of public POC keeps real-world risk moderate today, but browser memory corruption bugs with sandbox escape potential are historically attractive to exploit kit authors and targeted threat actors, so patching urgency remains high for Mac Chrome deployments. |
| Exploit ScenarioDerived | An attacker hosts a webpage containing crafted HTML and WebGPU shader content designed to trigger memory corruption in Chrome's Tint library during page rendering. When a macOS user visits the page - through a phishing link, malvertising, or a compromised site - the Tint component processes the malicious content, corruption occurs in memory, and the attacker achieves arbitrary code execution that breaks out of Chrome's renderer sandbox and runs at the OS user's privilege level. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Memory corruption in Chrome's Tint graphics library on macOS allows remote attackers to potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. All Google Chrome versions prior to 152.0.7977.65 on Mac are affected. No public exploit identified at time of analysis; despite the high CVSS score of 8.8, EPSS sits at 0.25% (16th percentile), indicating low observed exploitation activity, though the explicit sandbox-escape outcome elevates real-world severity above the raw score suggests.
RemediationAI
Vendor-released patch: Chrome 152.0.7977.65. Upgrade Chrome on all macOS endpoints to 152.0.7977.65 or later; the stable channel release notes are at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. Chrome's auto-update mechanism should deliver this for consumer installations, but enterprise administrators should validate rollout via Chrome Browser Cloud Management or equivalent MDM policy and enforce version floors. As a compensating control pending patch deployment, blocking navigation to untrusted or unrecognized external URLs via proxy or DNS filtering reduces exposure by preventing delivery of the crafted HTML page; note this trades browsing capability for risk reduction and does not eliminate the vulnerability. Disabling WebGPU via enterprise policy (setting WebGpuAllowed to false) may reduce the Tint attack surface, though this will break sites relying on WebGPU functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tint is a shader language compiler and graphics abstraction library used by Chromium for WebGPU operations, translating WebGPU shader code to platform-native representations. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the root-cause class, encompassing buffer overflows, out-of-bounds reads/writes, and heap corruption. The vulnerability is scoped exclusively to Chrome on macOS, suggesting platform-specific memory layout or API behavior in how Tint handles certain graphics operations. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions preceding 152.0.7977.65. The Chromium issue tracker entry is https://issues.chromium.org/issues/508638064, which may carry additional technical detail once public disclosure restrictions lift.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description explicitly states execution outside the Chrome sandbox, indicating scope change (S:C); all other metrics align with network-delivered, user-triggered, unauthenticated exploitation.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome for macOS users face a memory corruption vulnerability that enables attackers to escape the browser sandbox and execute arbitrary code when visiting crafted webpages, affecting all versions before 152.0.7977.65. This vulnerability bypasses Chrome's primary security boundary, creating direct risk of endpoint compromise for any organization with Mac-based staff. The availability of a vendor patch makes immediate deployment a critical operational priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-119 – Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB