CVE-2026-9999: Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148

Synopsis

This is a sandbox-contained arbitrary code execution vulnerability in the ANGLE graphics layer of Google Chrome on macOS, affecting all versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page controlled by the attacker. Successful exploitation lets the attacker run arbitrary code inside the Chrome sandbox process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to deliver content to the victim over the network, as the attack vector is Network (AV:N).

• AuthenticationNot required

  No account or credentials are needed on the targeted system; the attacker operates as an unauthenticated remote party (PR:N).

• Victim interactionRequired

  The victim must navigate to or open a crafted HTML page supplied by the attacker, making social engineering a necessary step (UI:R).

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or specific memory layout assumptions are required to trigger the flaw (AC:L).

Blast Radius

• Reads protected in-browser data such as session tokens, saved credentials, and page content from the compromised renderer process (C:H).
• Modifies in-process data and browser state, enabling the attacker to alter rendered content or inject behavior into the active browsing context (I:H).
• Crashes or destabilizes the renderer process, causing loss of the active browsing session and any unsaved in-page data (A:H).
• All impact is bounded by the Chrome sandbox on macOS; escalation beyond the sandbox is not implied by this CVE.