CVE-2026-9990: Chrome WebAppInstalls Use-After-Free on macOS

Technical summary

CVE-2026-9990 is a use-after-free memory vulnerability (CWE-416) in the WebAppInstalls component of Chromium. The flaw occurs when Chrome on macOS processes a crafted HTML page while a user engages in particular UI gestures, causing the application to reference memory that has already been freed. This heap corruption can be leveraged to achieve arbitrary code execution or denial of service. The vulnerability is classified as High severity by Chromium's security team, with a CVSS 3.1 score of 7.5 reflecting the network-accessible attack vector, high user interaction requirement, and significant confidentiality, integrity, and availability impact.

Business impact

Organizations with macOS-based workforces using Chrome face potential data exfiltration and system compromise risks if employees visit attacker-controlled websites. While the vulnerability requires user interaction, phishing campaigns or malicious advertisements could lower the practical barrier to exploitation. Compromised systems could lead to theft of credentials, intellectual property, or sensitive communications. The impact extends beyond individual machines to potential lateral movement within corporate networks if Chrome's sandbox is fully bypassed.

Affected systems

Google Chrome on Apple macOS is the primary affected platform. Specifically, any version of Chrome prior to 148.0.7778.216 running on macOS is vulnerable. Desktop macOS systems in corporate and personal use are at risk; iOS, Android, Linux, and Windows Chrome instances are not affected by this particular vulnerability. Organizations should verify their Chrome deployment versions across macOS infrastructure.

Exploitability

Exploitation requires a user to visit a malicious or compromised webpage and perform specific UI interactions with Chrome's web app installation feature while viewing a crafted HTML page. The vulnerability has not been designated for inclusion in CISA's Known Exploited Vulnerabilities catalog, indicating no widespread active exploitation in-the-wild has been documented at publication. However, the network-accessible attack surface and moderate user interaction requirement make it a viable target for targeted phishing or drive-by download campaigns. The technical barrier to exploitation is moderate; success depends on reliable heap manipulation and the attacker's ability to trigger the specific UI gesture sequence.

Remediation

Users and administrators should prioritize updating Google Chrome on macOS to version 148.0.7778.216 or later. Automatic updates should be enabled where possible. As an interim measure, users can reduce exposure by avoiding untrusted websites and disabling or restricting web app installation features until patching is complete. Organizations can enforce Chrome version policies through device management tools and monitor deployment progress to ensure compliance.

Patch guidance

Verify that Chrome on all macOS devices has been updated to version 148.0.7778.216 or a subsequent release. Chrome's auto-update mechanism typically deploys patches within days of release, but manual verification is recommended for critical systems. Access Chrome's version information via Menu > About Google Chrome (macOS will prompt to relaunch if an update is pending). For managed deployments, use your MDM or Enterprise policies to enforce minimum version requirements and track remediation progress. Schedule testing of the patched version in a non-production environment first to confirm compatibility with any custom web app installations.

Detection guidance

Monitor Chrome crash logs and diagnostic data for signals of heap corruption or unexpected termination in the WebAppInstalls component. Endpoint detection and response (EDR) tools should flag attempts to install suspicious web apps or anomalous memory access patterns during web app installation workflows. Network-level detection is limited; focus instead on behavioral signals such as unusual process spawning from Chrome or unexpected child processes. Log and alert on installation of web apps from unexpected or untrusted domains. Threat intelligence feeds may provide indicators of campaigns exploiting this vulnerability once active exploitation emerges.

Why prioritize this

This vulnerability merits prompt but measured prioritization. The High CVSS score, network accessibility, and potential for memory corruption reflect genuine risk. However, the lack of observed in-the-wild exploitation and the requirement for user interaction (specific UI gestures combined with a crafted page) prevent it from being a critical emergency. Organizations should treat this as a standard security patch to be deployed within 2–4 weeks, with accelerated timelines for systems handling highly sensitive data or those exposed to targeted threat actors known to conduct browser-based supply chain attacks.

Risk score, explained

The CVSS 3.1 score of 7.5 (High) reflects: (1) an unauthenticated network attack vector requiring no prior access; (2) high complexity due to the need for specific UI interactions and memory manipulation; (3) mandatory user interaction (the attacker must convince the user to perform gestures); (4) impact limited to the user's system (scope unchanged); but (5) high impact across all three security dimensions—confidentiality (data theft), integrity (memory corruption enabling arbitrary writes), and availability (potential denial of service). The complexity and user interaction requirements prevent a Critical rating, but the potential for heap exploitation justifies the High severity assignment.

Frequently asked questions