CVE-2026-9885: Insufficient validation of untrusted input in UI in Google Chrome on Mac prior to 148

Synopsis

This is an insufficient input validation vulnerability in Google Chrome on macOS, affecting versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page, and it is only exploitable by an attacker who has already compromised the Chrome renderer process. Successful exploitation enables a full sandbox escape, giving the attacker the ability to read, modify, and disrupt data and processes outside the browser sandbox with high impact across confidentiality, integrity, and availability. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the affected Chrome instance must be reachable by or directed to a remote origin.

• AuthenticationNot required

  No credentials or authenticated session are needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or be socially engineered into opening the crafted HTML page in Chrome on macOS.

• Attack complexityDetail

  Attack complexity is high because the attacker must have already compromised the Chrome renderer process before the sandbox escape primitive is reachable, introducing a significant precondition.

Blast Radius

• Attacker escapes the Chrome browser sandbox on macOS, gaining code execution in a context outside the renderer's restricted environment.
• With sandbox escape achieved, the attacker reads files and data accessible to the user running Chrome, including stored credentials, cookies, and session tokens.
• The attacker modifies files, configuration, or persisted application data on the host system with the privileges of the Chrome process owner.
• The attacker disrupts running processes or the operating system environment, up to and including crashing or destabilizing the affected host.