CVE-2026-9930: Out-of-Bounds Write in Chrome for macOS

Technical summary

CVE-2026-9930 is an out-of-bounds write flaw (CWE-787) in the Dawn graphics abstraction layer used by Chromium. The vulnerability exists in Chrome for macOS and allows a remote attacker to write beyond buffer boundaries via a specially crafted HTML payload. The attack vector is network-based with no privilege requirement, though successful exploitation depends on user interaction. Chromium has classified this as High security severity within their internal taxonomy, whereas the CVSS v3.1 score of 4.3 reflects a Medium severity rating with limited impact to integrity (I:L) and no impact on confidentiality or availability. The discrepancy between Chromium's severity label and the CVSS score suggests the vulnerability's real-world exploitation may be constrained by browser sandbox protections or other mitigating factors.

Business impact

For organizations with macOS users running vulnerable versions of Chrome, this vulnerability presents a targeted attack surface, particularly if those users browse untrusted or compromised websites. The primary risk is data integrity corruption rather than data exfiltration or system unavailability. However, out-of-bounds writes in graphics components can occasionally be chained with other flaws to escape sandbox restrictions, which would elevate risk significantly. Organizations should assess the prevalence of vulnerable Chrome versions in their environment and the criticality of the systems on which those browsers run. This is not an enterprise-grade threat that justifies emergency IR mobilization, but it warrants standard patch cycle inclusion.

Affected systems

The vulnerability is specific to Google Chrome on Apple macOS prior to version 148.0.7778.216. It does not affect Chrome on Windows, Linux, or other platforms, nor does it affect other Chromium-based browsers unless they independently integrate the affected Dawn version without patching. macOS users on older or unpatched Chrome builds remain exposed; enterprise deployments should verify their Chrome version against the fixed build number.

Exploitability

Exploitation requires a remote attacker to host or inject a malicious HTML page and convince or trick a user into visiting it—there is no watertight method to force code execution through this flaw alone. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is straightforward to mount (low complexity) but strictly dependent on user action. The vulnerability is not known to be exploited in the wild, as it has not been added to the CISA KEV catalog. No public exploit code is available. The Chromium sandbox will likely prevent the memory corruption from directly compromising the host OS, though attackers could potentially use this alongside renderer process exploits to break out of the sandbox.

Remediation

Update Google Chrome on macOS to version 148.0.7778.216 or later. Users can enable automatic updates in Chrome settings (Chrome menu > Settings > About Chrome), which will trigger a download and install cycle, typically requiring a browser restart. Organizations should verify patch deployment through mobile device management (MDM) solutions or enterprise Chrome update policies to ensure no machines remain on vulnerable versions.

Patch guidance

Navigate to Chrome's Settings > About Chrome to check the current version and force an immediate update check. The patch is cumulative; simply updating to 148.0.7778.216 or any later version resolves the vulnerability. Verify the browser restarts to complete the update. For managed deployments, confirm that Chrome enterprise policies (update_default or similar) are configured to allow auto-updates, and validate patch application across your device inventory within 2–4 weeks of release depending on your risk tolerance and the prevalence of vulnerable versions in your environment.

Detection guidance

Monitor Chrome version compliance via endpoint detection and response (EDR) tools, mobile device management consoles, or manual inventory scans on macOS devices. Look for any instances of Chrome prior to 148.0.7778.216. Web traffic inspection can identify suspicious HTML payloads attempting to trigger out-of-bounds writes, though the specific payload signature is difficult to generalize without access to exploit proof-of-concepts. Network-based detection is less viable; endpoint version monitoring is the primary control.

Why prioritize this

Although Chromium rates this as High severity, the CVSS v3.1 Medium score (4.3) and lack of active exploitation (KEV not listed) place this in the standard patching queue rather than the emergency category. The graphics layer vulnerability combined with the macOS-only scope and user-interaction requirement reduces the blast radius. Prioritize patching for users who frequently visit untrusted websites or receive phishing campaigns, and ensure standard-cadence updates are applied fleet-wide within 30 days.

Risk score, explained

The CVSS score of 4.3 reflects the limited scope of impact: integrity is affected (ability to write out of bounds) but confidentiality and availability are not directly impacted. The requirement for user interaction (UI:R) and network attack vector (AV:N, AC:L) yield a Medium severity. Chromium's internal High severity label may reflect a higher theoretical risk of sandbox escape or chaining with other renderer bugs, but the observed impact in the wild appears constrained by browser isolation features. The absence of KEV catalog inclusion indicates no active, widespread exploitation as of the advisory date.

Frequently asked questions