CVE-2026-76035: Google Chrome Media RCE Vulnerability

CVE-2026-76035 Overview

CVE-2026-76035 is an inappropriate implementation flaw in the Media component of Google Chrome on macOS. The vulnerability affects Chrome versions prior to 151.0.7922.169 and allows a remote attacker to execute arbitrary code outside the browser sandbox through a crafted HTML page. Chromium's security team rated the underlying issue High, and the National Vulnerability Database assigned a CVSS 3.1 score of 9.6 with scope change, reflecting the sandbox escape. The weakness is categorized under [CWE-20] (Improper Input Validation).

Critical Impact
A single visit to an attacker-controlled web page can trigger arbitrary code execution outside the Chrome renderer sandbox on macOS endpoints.

Affected Products

Google Chrome for macOS versions prior to 151.0.7922.169
Chromium-based browsers on macOS incorporating the vulnerable Media component
Embedded frameworks reusing the affected Chromium Media stack on macOS

Discovery Timeline

2026-08-18 - CVE-2026-76035 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76035

Vulnerability Analysis

The flaw resides in Chrome's Media component on macOS. Improper input validation in media handling logic allows a crafted HTML page to manipulate execution flow beyond intended boundaries. A successful attack breaks out of the Chrome renderer sandbox, granting the attacker code execution in the context of a less-restricted browser process on the host.

The issue requires user interaction, meaning the victim must load the malicious page. The scope change indicates that exploitation impacts resources beyond the vulnerable component, which is consistent with a sandbox escape scenario. Public technical details remain limited while patch adoption ramps up. Refer to the Chromium Issue Tracker #536439844 for engineering context.

Root Cause

The root cause is an inappropriate implementation in the Media subsystem, tracked as [CWE-20] Improper Input Validation. The component fails to correctly validate or constrain input processed during media decoding or rendering, allowing malformed data to trigger unsafe behavior that crosses the sandbox boundary on macOS.

Attack Vector

Exploitation requires an attacker to host a crafted HTML page containing malicious media content. When a user on a vulnerable macOS Chrome build visits the page, the Media component processes attacker-supplied input and executes code outside the sandbox. Delivery mechanisms include phishing links, malicious advertisements, watering-hole compromises, and cross-site framing on trusted domains.

No authentication is required. Attack complexity is low, and the attack originates over the network. See the Google Chrome Desktop Update for the vendor's release notes.

Detection Methods for CVE-2026-76035

Indicators of Compromise

Chrome renderer or GPU processes spawning unexpected child processes such as /bin/sh, osascript, or curl on macOS
Unexpected outbound network connections from Chrome helper processes to previously unseen hosts shortly after a media-heavy page load
Creation of persistence artifacts under ~/Library/LaunchAgents/ or ~/Library/Application Support/ following browser activity

Detection Strategies

Inventory macOS endpoints running Chrome versions earlier than 151.0.7922.169 using endpoint telemetry or MDM reporting
Correlate browser process trees with post-exploitation behavior such as shell execution, file writes to sensitive user directories, and code signing anomalies
Alert on Chrome helper processes loading unsigned dynamic libraries or invoking macOS system utilities outside normal browsing patterns

Monitoring Recommendations

Ingest EDR process and network telemetry into a central data lake and hunt for anomalous parent-child relationships involving Google Chrome Helper
Monitor Chrome update compliance across the fleet and flag hosts that fail to reach the patched build within the maintenance window
Track visits to newly registered domains or low-reputation hosts observed alongside Chrome sandbox escape indicators

How to Mitigate CVE-2026-76035

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 151.0.7922.169 or later
Force a browser relaunch after update deployment to ensure the patched binaries are active
Prioritize high-risk user populations such as executives, developers, and administrators for immediate patching

Patch Information

Google addressed CVE-2026-76035 in the Chrome Stable channel release documented in the Google Chrome Desktop Update. The fix is included in Chrome 151.0.7922.169 for macOS. Chromium-derived browsers on macOS should apply the equivalent upstream fix as vendors publish updates.

Workarounds

Restrict browsing to trusted sites via enterprise policy until patching completes
Disable autoplay and block third-party media content through Chrome Enterprise policies where feasible
Deploy content filtering and DNS security controls to reduce exposure to malicious HTML pages

bash

# Verify Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force update via MDM or command line
open -a "Google Chrome" --args --check-for-update-interval=1