This vulnerability arises from insufficient validation of untrusted input in the Updater component of Google Chrome on Mac systems before version 151.0.7922.72. An attacker who has already compromised the renderer process could exploit this flaw by crafting a malicious HTML page to perform a sandbox escape, potentially increasing their privileges or access beyond the renderer sandbox. The CVSS v3.1 base score is 5.8, indicating medium severity, with attack vector network, high attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker who has compromised the renderer process to escape the sandbox environment, potentially leading to increased access or control on the affected system. The impact on confidentiality, integrity, and availability is rated low, but the sandbox escape could facilitate further attacks.

A fix is available in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html provides official update guidance.