An inappropriate implementation in the Network component of Google Chrome on macOS enables a remote attacker who has already compromised the renderer process to escape the browser’s sandbox by serving a specially crafted HTML page. This flaw permits privilege escalation from the restricted renderer to the host operating system, potentially allowing full system compromise. The vulnerability carries a CVSS score of 9.6, indicating critical severity.

Google Chrome for macOS, all versions prior to 151.0.7922.72. The flaw does not affect other browsers or platforms, as reported by the CNA.

The EPSS score is less than 1% and the issue is not listed in the CISA KEV catalog, reflecting a low current exploitation probability. Nevertheless, the high CVSS score and the ability to bypass the sandbox make the risk significant. The likely attack vector is remote: an attacker must first compromise the renderer—typically via malicious web content—and then deliver a crafted HTML page to trigger the sandbox escape. While this requires initial renderer compromise, once achieved the attacker can execute arbitrary code with elevated privileges on the host.