The vulnerability is an incorrect reference resolution in image handling within Google Chrome on macOS prior to version 157.0.8103.38. A renderer process that has already been compromised can be leveraged by a remote attacker to send specially crafted network traffic that triggers the flaw, allowing the attacker to execute arbitrary code outside the renderer’s sandbox. This enables code execution with the privileges of the renderer and potentially elevated privileges on the host system.

All macOS installations of Google Chrome using the stable channel before version 157.0.8103.38 are affected. No other platforms, vendors, or product lines were reported to be impacted.

The CVE is classified as high severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to have already compromised the renderer process; once that precondition is met, a network-based attack sending malformed image references can trigger the flaw. The attack vector is therefore dependent on network traffic to a vulnerable Chrome instance running on macOS.