CVE-2026-9999

What it actually does

This vulnerability is a high-severity memory-corruption or inappropriate-implementation flaw in ANGLE, Chrome’s graphics translation layer, affecting Google Chrome on macOS before version 148.0.7778.216. A crafted HTML page can trigger unsafe behavior in the browser’s rendering or graphics pipeline and allow arbitrary code execution within Chrome’s sandboxed renderer context. Successful exploitation can compromise the confidentiality, integrity, and availability of browser-accessible data and processes, but the described impact is sandbox-contained unless paired with a separate sandbox escape or privilege-escalation vulnerability.

Why it matters to the business

If exploited, this flaw could allow an attacker to compromise a user’s browser after the user visits a malicious or compromised webpage. Business consequences may include theft of web session data, unauthorized actions in web applications, browser instability, and potential foothold creation for further attacks if chained with another vulnerability. Although it is not listed in CISA KEV, has low EPSS, and has no known mature exploit in the provided data, browser vulnerabilities are widely exposed because users regularly interact with untrusted web content, so timely Chrome updates remain important.

How an attack unfolds

An attacker hosts or injects a malicious HTML page containing content designed to exercise the vulnerable ANGLE code path in Chrome on macOS. The victim must open the page, for example through phishing, malvertising, a compromised legitimate site, or a link in chat or email. When Chrome processes the crafted page, the ANGLE implementation mishandles memory or graphics-related state, allowing the attacker’s payload to execute code inside the Chrome renderer sandbox. From that position, the attacker may attempt to read or manipulate browser-accessible content, steal session tokens or sensitive page data available to the compromised renderer, or chain the exploit with a separate sandbox escape to gain broader system access. No known exploitation, ransomware usage, or named threat actor activity is indicated in the provided data.

How to fix it

Upgrade Google Chrome on macOS to version 148.0.7778.216 or later. Where centralized browser management is available, enforce automatic updates and verify that update deferrals do not leave macOS endpoints below the fixed version. If immediate patching is not possible, reduce exposure by restricting access to untrusted websites, using web isolation for high-risk browsing, disabling unnecessary browser extensions, and enforcing phishing and malvertising protections; however, these are compensating controls and should not replace upgrading. Keep macOS and endpoint security tools current because browser code-execution flaws are often chained with OS or sandbox-escape vulnerabilities.

How to confirm the fix worked

Confirm that Chrome on macOS reports version 148.0.7778.216 or later via chrome://settings/help, enterprise browser inventory, endpoint management tooling, or by checking the installed application version. Validate that automatic updates are enabled and that no managed policy is pinning Chrome to a vulnerable release. Security teams can scan software inventory for Google Chrome installations on macOS with versions earlier than 148.0.7778.216. Because exploitation requires user interaction with crafted web content, also validate that web filtering, phishing protection, and browser isolation controls are active where used.

Typical attack path

1. Attacker prepares a crafted HTML page that triggers the vulnerable ANGLE code path in Chrome on macOS.
2. Attacker delivers the page through phishing, malvertising, a compromised website, or another web-based lure.
3. User opens the malicious page in a vulnerable Chrome version prior to 148.0.7778.216.
4. Chrome processes the crafted content and triggers the memory-corruption condition in ANGLE.
5. Attacker achieves arbitrary code execution within the Chrome sandboxed renderer context.
6. Attacker attempts browser data theft, unauthorized web actions, persistence through browser mechanisms, or chaining with another vulnerability for sandbox escape or system-level compromise.

How to detect it

Look for signs that a vulnerable Chrome browser on macOS visited a malicious or unusual webpage shortly before browser crashes, suspicious renderer behavior, or unexpected child processes. Useful data sources include Chrome version inventory, endpoint detection and response telemetry, macOS unified logs, browser crash reports, DNS logs, proxy logs, secure web gateway logs, and email security logs showing links clicked by users. Investigate repeated Chrome renderer or GPU process crashes, visits to suspicious domains immediately preceding crashes, downloads or scripts initiated by Chrome, and any process spawned unexpectedly from the Chrome application context. Since no public exploit indicators, threat actors, or known exploit maturity are provided, detection should be behavior-based rather than relying on a fixed signature. Pay particular attention to follow-on activity such as credential access, suspicious browser extension installation, unusual access to web applications from an affected user session, or attempts to execute binaries from temporary or user-writable directories after Chrome activity.

• Google Chrome version < 148.0.7778.216 on macOS
• /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
• Google Chrome Helper (Renderer)
• Google Chrome Helper (GPU)
• chrome://crashes
• ANGLE
• --type=renderer
• --type=gpu-process

What your security team should do

• Prioritize updating all Google Chrome installations on macOS to 148.0.7778.216 or later, especially for users with elevated business access or frequent exposure to external web content.
• Use endpoint or browser management telemetry to identify Chrome on macOS versions earlier than 148.0.7778.216 and remediate them.
• Ensure Chrome automatic updates are enabled and not blocked by enterprise policy, network controls, or user permissions.
• Monitor for crashes, suspicious child processes, and unusual browser behavior around visits to unknown or recently registered websites.
• Treat alerts involving Chrome renderer compromise as potentially chainable with sandbox escapes, and investigate for follow-on activity beyond the browser process.
• Maintain web protection controls such as safe browsing, DNS filtering, malicious ad blocking, and email link rewriting to reduce the chance of users reaching exploit pages.