CVE-2026-10920: Insufficient validation of untrusted input in WebShare in Google Chrome on Mac prior to 149

Synopsis

This is an insufficient input validation vulnerability in the WebShare API implementation of Google Chrome on macOS, affecting versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, though a victim must interact with a crafted HTML page and the attacker must have already compromised the renderer process. Successful exploitation allows the attacker to escape Chrome's sandbox, gaining capabilities beyond the browser process and potentially achieving full system-level code execution. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target host must be reachable via a browser session to an attacker-controlled or compromised web origin.

• AuthenticationNot required

  No account credentials or prior authentication are needed; the attack is launched from an unauthenticated web context.

• Victim interactionRequired

  A user must visit and interact with a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must have already compromised the Chrome renderer process before leveraging this flaw for sandbox escape.

Blast Radius

• The attacker breaks out of Chrome's sandbox, gaining execution rights beyond the browser process on the host macOS system.
• With sandbox escape achieved, the attacker reads files and credentials stored outside the browser sandbox, including keychain data and session tokens accessible to the user account.
• The attacker writes or modifies files on the filesystem, enabling persistence mechanisms or tampering with locally stored application data.
• The attacker crashes or disrupts the Chrome process and potentially other user-space processes reachable under the same user context.