CVE-2026-76035: Inappropriate implementation in Media
Chromium: CVE-2026-76035 Inappropriate implementation in Media
Other sources
Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
— NVD
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 151.0.7922.169 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 151.0.4129.101
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Which systems are exposed and what does an attacker need to exploit this?
Users of Google Chrome on Mac with versions earlier than 151.0.7922.169 are affected. The issue is triggered remotely through a crafted HTML page.
Is a non-default configuration required for exploitation?
The provided information does not identify a configuration prerequisite or user action beyond reaching a crafted HTML page. Treat affected Chrome installations on Mac as exposed when they browse attacker-controlled or malicious web content.
What is the remediation?
Update Google Chrome on Mac to version 151.0.7922.169 or later. The provided information does not specify an alternative mitigation if updating is not immediately possible.