EUVD-2026-79963
GHSA-5m8h-hhr7-wjg9
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (google) · only source for this CVE.
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Google Chrome on macOS versions prior to 153.0.8010.47 contain a race condition (TOCTOU) in the Extensions subsystem that lets an attacker who has already compromised the browser's renderer process break out of the sandbox and execute arbitrary code on the host, triggered when a victim loads a crafted HTML page. Google rated the issue High severity and Chromium's own severity assessment drove the 8.3 CVSS base score with a Scope change (S:C), reflecting that code execution crosses the renderer/sandbox boundary rather than staying contained. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today