This vulnerability arises from an inappropriate implementation in the WebAppInstalls feature of Google Chrome on Mac platforms before version 150.0.7871.47. An attacker with control over the renderer process could exploit this flaw by delivering a crafted HTML page to perform a sandbox escape, thereby potentially gaining elevated privileges beyond the renderer sandbox. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects that the attack can be performed remotely with low complexity, requires user interaction, and results in complete system compromise. Although the vulnerability is critical, no public exploits have been observed. The vendor advisory linked does not explicitly state patch availability or remediation instructions.

Successful exploitation allows a remote attacker who has compromised the renderer process to escape the sandbox environment, potentially leading to full system compromise on affected Mac systems running vulnerable Chrome versions. This impacts confidentiality, integrity, and availability of the system. The vulnerability is rated critical with a CVSS score of 9.6, indicating severe risk if exploited.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official fixes are confirmed and applied, users should exercise caution with untrusted content and consider limiting exposure to potentially malicious HTML pages. Monitor official Google Chrome release notes for updates regarding this vulnerability.