What is the CVSS score of CVE-2026-9999?

CVE-2026-9999 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9999?

Google Chrome on macOS contains a high-severity remote code execution vulnerability (CVE-2026-9999, CVSS 8.8) in the ANGLE graphics layer that allows attackers to execute arbitrary code within the…. A patch is available.

How to fix or mitigate CVE-2026-9999?

Within 24 hours: Notify all macOS users and administrators of the vulnerability; mandate immediate update to Chrome version 148.0.7778.216 or later and activate forced-update policies where available. Within 7 days: Verify successful deployment across all macOS endpoints using MDM, configuration management tools, or browser version audits; remediate any systems still running vulnerable versions. Within 30 days: Review browser crash reports, access logs, and security event logs for evidence of exploitation attempts or visits to potentially malicious sites prior to patching.

Google Chrome CVE-2026-9999

EUVD-2026-33141 HIGH

Improper Privilege Management (CWE-269)

2026-05-28 Chrome

GHSA-qg99-3fxw-j5pv

Privilege Escalation RCE Google Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:22 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a victim to visit a crafted HTML page that triggers an inappropriate implementation flaw in the ANGLE graphics layer. The issue is rated High by Chromium and carries a CVSS 3.1 score of 8.8 with user interaction required; no public exploit identified at time of analysis and EPSS is low at 0.04%.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chromium uses to convert OpenGL ES API calls into the platform's native graphics API - on macOS this maps to Metal (and historically OpenGL). Because ANGLE handles WebGL and accelerated canvas content from untrusted web pages, flaws in its implementation are directly reachable from JavaScript and have historically been a rich source of GPU-process compromises. The CWE-269 (Improper Privilege Management) classification combined with the description's note that code executes 'inside a sandbox' suggests the bug yields execution in the GPU/renderer process context rather than a full sandbox escape, though privilege handling within the GPU process is implicated. The CPE narrows the affected product to Google Chrome desktop on macOS.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 for macOS - upgrade immediately via the Chrome Stable channel update referenced at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. In managed environments, push the update via MDM (Jamf, Intune, Kandji) and force-restart Chrome to apply, since Chrome only completes the update after a relaunch. If patching must be deferred, compensating controls include disabling hardware acceleration in chrome://settings (which reduces ANGLE attack surface at the cost of degraded rendering performance and broken WebGL content), enforcing the SitePerProcess policy and Strict Site Isolation (already default but worth verifying via chrome://policy), and using Chrome Enterprise policies to block untrusted sites or restrict WebGL on high-risk user populations. Track the upstream issue at https://issues.chromium.org/issues/513364480 for further detail once Google removes the view restriction.