Description

Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:02.590Z",
  "pubdate": "2026-08-25T21:18:02.590Z",
  "executiveSummary": "This vulnerability involves a memory corruption flaw within the Tint component of Google Chrome on macOS, identified prior to version 152.0.7977.65.\nThe vulnerability is categorized as a high-severity security issue that permits a remote attacker to achieve arbitrary code execution.\nBy leveraging a specifically crafted HTML document, an attacker can bypass standard browser sandbox protections, potentially leading to full system compromise or unauthorized execution of malicious payloads on the host device.\nThe attack vector is remote, requiring only that a user navigates to a compromised or attacker-controlled web page. Successful exploitation exploits the browser's memory management mechanisms, creating significant risk for users running outdated versions of the software.\nDue to the nature of memory corruption bugs, this flaw represents a significant threat to confidentiality, integrity, and availability of the user's computing environment.",
  "technicalDetails": "The vulnerability resides within the Tint component of the Chromium browser engine as implemented in Google Chrome for macOS. Tint is responsible for various graphics and UI-related rendering tasks; memory corruption here typically stems from improper handling of data structures, buffer overflows, or use-after-free conditions during the processing of complex HTML/CSS or related media content.\nThe root cause is an unsafe memory operation that allows an attacker to manipulate the process memory space. When the browser processes a crafted HTML page, the Tint component fails to properly validate or sanitize the input, leading to a state where an attacker can achieve controlled memory writes or reads. This corruption can be used to overwrite critical function pointers, internal object metadata, or return addresses in the stack, eventually diverting the execution flow of the browser process.\nThe exploitation flow typically begins when a user is enticed to visit a malicious URL. Once the browser parses the crafted HTML, the vulnerable Tint component triggers the memory corruption during the rendering phase. Because the flaw exists within a privileged context or allows for the escalation of privileges, the attacker can leverage this primitive to escape the browser's sandbox environment.\nSandbox escape is the critical post-exploitation phase where the attacker transitions from executing code within the restricted browser process to the host operating system level. By bypassing these security boundaries, the attacker gains the ability to execute arbitrary commands, install persistent backdoors, or access sensitive user data residing outside the browser's isolated environment. This effectively negates the security guarantees provided by the Chrome sandbox.\nThe affected versions include all Google Chrome releases on macOS prior to 152.0.7977.65. There is no requirement for authentication or local access to the machine, making this a zero-click or one-click remote code execution (RCE) vector depending on the delivery method, such as a malicious advertisement or a direct hyperlink. Exploitation relies on the browser's legitimate functionality to process dynamic web content, which the Tint component treats as trusted input, leading to the eventual degradation of the application's memory safety state."
}