CVE-2026-12468: Race in Updater in Google Chrome on Mac prior to 149

Synopsis

A race condition in the Google Chrome updater component on macOS allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network but requires victim interaction and high attack complexity due to the race window involved. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the sandbox, effectively granting arbitrary code execution on the host. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version of Chrome on Mac.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the affected service must be reachable remotely.

• AuthenticationNot required

  No account or credentials are needed to initiate the attack; any user browsing to the attacker-controlled page is a valid target.

• Victim interactionRequired

  The targeted user must visit a crafted HTML page, making this a social-engineering vector that requires the victim to take an action.

• Attack complexityDetail

  Exploitation depends on winning a race condition in the updater, meaning the attacker must time the exploit correctly and success is not guaranteed on every attempt.

Blast Radius

• An attacker who wins the race condition escapes the Chrome renderer sandbox and gains code execution at a higher privilege level on the host macOS system.
• With sandbox escape achieved, the attacker can read files and credentials stored outside the browser profile, including keychain entries and session tokens accessible to the user account.
• The attacker can write or modify files on the filesystem, enabling persistence mechanisms such as launch agents or modification of application binaries.
• The attacker can crash or terminate processes on the host, disrupting any service or application running under the compromised user account.