Description
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-05-28
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Inappropriate handling within the ANGLE graphics layer of Google Chrome on macOS prior to version 148.0.7778.216 permits a remote attacker to execute arbitrary code within the browser sandbox by delivering a specially crafted HTML page. The flaw involves unsafe code evaluation (CWE-94), enabling the attacker to hijack control flow within the sandboxed environment.

Affected Systems

All Google Chrome builds for macOS released before 148.0.7778.216 are vulnerable; any earlier stable channel build on Mac falls within this scope.

Risk and Exploitability

The CVSS score is 8.8 and the vulnerability is not listed in CISA KEV, yet it is classified as high severity by Chromium. The EPSS score is <1%, indicating a very low probability of exploitation. Because the flaw is triggered by a crafted HTML page that can be served over the web, remote exploitation is possible and would execute code within the sandbox. While the sandbox may restrict some system interactions, the level of impact depends on the host’s sandbox configuration. Given the lack of known exploit tooling but the high severity classification, the overall risk remains significant for affected users.

Generated by OpenCVE AI on May 29, 2026 at 17:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 148.0.7778.216 or newer to eliminate the vulnerability.
  • Enable automatic updates for Google Chrome so that future security patches are applied without manual intervention.
  • Instruct users to avoid opening untrusted or unknown webpages, as the attack requires a malicious HTML page served to the client.

Generated by OpenCVE AI on May 29, 2026 at 17:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 29 May 2026 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Fri, 29 May 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Fri, 29 May 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-787

Fri, 29 May 2026 12:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via ANGLE in Chrome on Mac Before 148.0.7778.216 chromium-browser: Inappropriate implementation in ANGLE
Weaknesses CWE-94
References
Metrics threat_severity

None

 cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

threat_severity

Important

Fri, 29 May 2026 01:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via ANGLE in Chrome on Mac Before 148.0.7778.216
Weaknesses CWE-20
CWE-787

Fri, 29 May 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 28 May 2026 22:45:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-29T16:21:00.690Z

Reserved: 2026-05-28T17:25:11.013Z

Link: CVE-2026-9999

cve-icon Vulnrichment

Updated: 2026-05-29T16:07:35.289Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-05-28T23:16:58.140

Modified: 2026-05-29T18:17:18.940

Link: CVE-2026-9999

cve-icon Redhat

Severity : Important

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-9999 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-29T18:00:05Z

Weaknesses