Google Chrome on macOS prior to version 151.0.7922.72 contains an insufficient validation flaw in the Updater component that could allow a remote attacker who had already compromised the renderer process to escape the sandboxed environment. The vulnerability is grounded in CWE‑20 (Improper Input Validation) and CWE‑1286 (File and Resource Access Controls). Successful exploitation would enable the attacker to gain higher privileges on the host machine, potentially accessing system resources or executing arbitrary code.

Google Chrome for macOS, any version earlier than 151.0.7922.72. The issue is driven by the Updater module used for automatic updates in the Chrome browser.

The CVSS score of 5.8 indicates a medium severity flaw, while the EPSS score of less than 1% points to a very low probability of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog. Inference from the description suggests that an attacker must already have compromised the renderer process to trigger the sandbox escape, implying a higher prerequisite barrier compared to a pure remote exploit.