CVE-2026-11158

HighCVSS 8.6

Published: 04/06/2026(UTC)Updated: 08/06/2026(UTC)Translated: 09/06/2026(UTC)NVD NIST

Summary

Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to version 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command.

Risk Assessment

A local attacker could exploit this vulnerability to gain unauthorized access to the system, potentially leading to serious data security implications.

Recommendation

It is recommended to update Google Chrome to the latest version to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. (Chromium security severity: Medium)