CVE-2026-17865

chromium-browser: chromium-browser: Inappropriate implementation in Crypto

View on CVE.org
Published Jul 30, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Description
Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

The vulnerability is an insecure cryptographic implementation in Google Chrome for macOS, identified as CWE‑501. A remote attacker who can compromise the renderer process may deliver a specially crafted HTML page that triggers a sandbox escape, allowing code execution beyond the browser's isolation. The impact is a privilege escalation that can compromise the host system and jeopardise confidentiality, integrity, and availability.

Affected Systems

Google Chrome on macOS versions prior to 151.0.7922.72 are affected. Users running these releases are at risk when a malicious web page can exploit the compromised renderer.

Risk and Exploitability

The CVSS score of 9.6 indicates high severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve serving a malicious HTML payload that escalates privileges once the renderer process is compromised.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome on macOS to version 151.0.7922.72 or newer
  • Enable macOS Gatekeeper to block the execution of untrusted applications
  • Ensure Chrome Safe Browsing is enabled and kept up to date to detect malicious sites

Generated by OpenCVE AI on August 2, 2026 at 06:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History
Type Values Removed Values Added
Weaknesses CWE-693
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}
Type Values Removed Values Added
Title chromium-browser: chromium-browser: Inappropriate implementation in Crypto
Weaknesses CWE-501
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

threat_severity

Moderate
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
References
Weaknesses
  • CWE-501

    Trust Boundary Violation

  • CWE-693

    Protection Mechanism Failure

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jul 31, 2026, 6:40 PM
Reserved
Jul 27, 2026, 11:35 PM

View source JSON

Updated
Jul 31, 2026, 6:40 PM

JSON

Status
Analyzed
Published
Jul 30, 2026, 1:16 AM
Modified
Oct 23, 2026, 11:10 PM

View source JSON

Severity
Moderate
Public date
Jul 30, 2026, 12:19 AM

View source Bugzilla JSON

Updated
Aug 2, 2026, 6:30 AM

JSON