Google EUVD-2026-17784

The victim must visit or be redirected to a crafted HTML page in Google Chrome on macOS versions prior to 146.0.7680.178. Remote unauthenticated attacker requires user interaction (page visit). ANGLE graphics library processes malicious content triggering heap buffer overflow.

Despite the absence of a CVSS score, the vulnerability carries critical real-world risk based on multiple strong signals: the Chromium security team assigned 'High' severity (Chrome's internal severity framework), the vulnerability is a heap buffer overflow enabling arbitrary code execution via remote HTML delivery (unauthenticated attack vector with low complexity), and a patch has been released and is available. The absence of CVSS data does not diminish the threat; Chrome's own severity classification and the nature of the vulnerability (exploitable RCE in a ubiquitous browser) indicate this is a priority patch. The attack vector (remote, via crafted webpage) makes this accessible to a broad attack surface. Organizations should treat this as a critical priority regardless of EPSS or KEV status not being provided.

An attacker crafts a malicious HTML page containing specially formatted WebGL or Canvas 2D graphics code that exploits the heap buffer overflow in ANGLE's graphics processing logic. When a macOS user with Chrome version below 146.0.7680.178 visits this webpage, the browser parses the malicious graphics commands, triggering the out-of-bounds write in the heap. This allows the attacker to corrupt heap metadata or inject shellcode, achieving arbitrary code execution within the Chrome process's security context. The attack requires only that a user visit a webpage; no user interaction beyond normal browsing is necessary, making this a high-severity remote attack vector.