CVE-2026-12022
Google · Chrome
A race condition in the Safe Browsing feature of Google Chrome on Mac allows for a sandbox escape via a malicious file.
Executive summary
A high-severity race condition in Google Chrome's Safe Browsing feature on macOS could allow attackers to bypass sandbox protections.
Vulnerability
This vulnerability exists as a race condition within the Safe Browsing component. An attacker who has already compromised the renderer process can trigger this condition by delivering a malicious file, ultimately leading to a sandbox escape.
Business impact
With a CVSS score of 8.3, this flaw poses a substantial risk to organizational security. By exploiting the Safe Browsing mechanism, an attacker can bypass traditional security controls, potentially resulting in full system compromise for the targeted user.
Remediation
Immediate Action: Update Google Chrome to version 149.0.7827.115 or later immediately.
Proactive Monitoring: Monitor for anomalous file-handling activity and unusual system calls emanating from the browser process.
Compensating Controls: Deploy advanced threat protection solutions that perform deep inspection of downloaded files before they reach the browser's processing environment.
Exploitation status
Public Exploit Available: false
Analyst recommendation
The reliance on Safe Browsing for security makes this race condition particularly concerning. Administrators must prioritize the deployment of the latest browser updates to prevent potential sandbox breakouts and subsequent system exploitation.