CVE-2026-10920: Chrome macOS WebShare Sandbox Escape Vulnerability (v149)

Technical summary

CVE-2026-10920 stems from insufficient input validation in the WebShare implementation within Google Chrome on macOS. The vulnerability exists in a component that handles web-based file or data sharing operations. An attacker with renderer-process code execution can supply a malformed input that bypasses sandbox boundaries, leading to arbitrary code execution in the context of the browser process or system. The flaw is classified as CWE-20 (Improper Input Validation), indicating the root cause is inadequate sanitization or type checking before the input is processed by privileged code paths.

Business impact

For most users, this vulnerability poses moderate practical risk because it requires a two-stage attack: first compromising the renderer (through XSS, malicious script injection, or another browser vulnerability), then leveraging the WebShare flaw to escape the sandbox. However, in environments where users visit untrusted content or where other renderer-level vulnerabilities are exploited, this becomes a pathway to complete system compromise. Organizations running macOS fleets with Chrome users should treat this as a privilege-escalation vector that could amplify the impact of other web-based attacks.

Affected systems

Google Chrome on Apple macOS, versions prior to 149.0.7827.53, is directly affected. The vulnerability is specific to macOS; Chrome on Windows and Linux use different sandbox mechanisms and are not impacted. Users on older Chrome versions (148.x and earlier) are at risk if they run macOS. Verify your installed version via chrome://version in the address bar.

Exploitability

Exploitation requires two conditions: (1) the attacker must first achieve code execution within Chrome's renderer process (via XSS, drive-by download, or other renderer exploit), and (2) the attacker must then craft a specific HTML page or WebShare input to trigger the sandbox escape. The attack surface is the WebShare API, which is available to web content. While the initial renderer compromise is necessary, once achieved, the sandbox escape is likely highly reliable given the validation bypass nature of the flaw. CVSS 8.3 reflects the combination of high confidentiality, integrity, and availability impact, balanced by the prerequisite of renderer compromise and user interaction to trigger the initial infection vector.

Remediation

Update Chrome to version 149.0.7827.53 or later on all macOS systems. This patch closes the WebShare input validation flaw. No workarounds exist short of disabling WebShare (which would break legitimate share functionality), so patching is the only effective mitigation. Verify the updated version is running via chrome://version and confirm automatic updates are enabled.

Patch guidance

Google Chrome on macOS will attempt automatic updates; users can force an update check via Menu > About Google Chrome, which triggers immediate download and applies the patch on next restart. Enterprise deployments using managed Chrome (via Jamf, Intune, or similar MDM) should push version 149.0.7827.53 or later immediately. For large organizations, consider staged rollout to validate compatibility, though no compatibility issues with this patch version have been reported. After patching, verify via chrome://version that all instances show version 149.0.7827.53 or later.

Detection guidance

Monitor for Chrome version compliance on macOS systems using endpoint detection tools (Jamf Pro, Kandji, Intune) or vulnerability management platforms. Web-based detection is limited because exploitation would typically occur silently post-renderer-compromise; however, monitor for unusual WebShare API calls in application logs or JavaScript execution patterns. Look for attempts to invoke WebShare with malformed or oversized payloads, or monitor process behavior for unexpected child processes spawning from the Chrome helper process post-WebShare invocation. Indicators of successful exploitation would include unexpected system-level process creation originating from Chrome.

Why prioritize this

Although this CVE is not listed on the CISA Known Exploited Vulnerabilities catalog (KEV=false), the 8.3 CVSS score, HIGH severity designation from Chromium, and the nature of sandbox-escape vulnerabilities mean it should be patched urgently. Sandbox escapes are particularly concerning because they enable post-compromise lateral movement and persistence. Prioritize macOS Chrome users who regularly visit untrusted or high-risk content, and any environments where Chrome is used to access user-generated content or third-party web applications. Patch within 30 days; sooner if you have external-facing web browsing.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects: Attack Vector = Network (remote exploitation possible via webpage), Attack Complexity = High (requires renderer compromise first), Privilege Escalation = Yes (from renderer sandbox to system), Confidentiality = High (full system access), Integrity = High (system modification possible), Availability = High (denial of service or system crash possible). The AC=H factor accounts for the prerequisite renderer compromise, preventing a CRITICAL rating, but the sandbox-escape nature and full system impact justify the HIGH severity.

Frequently asked questions