CVE-2026-9999

Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.25% chance of exploitation in the next 30 days, 16th percentile

Published

2026-05-28

Updated

2026-05-30

Proof-of-concept exploits (2)

• josephfarah-ciso/CVE-2026-9999-exploit0★ · 2026-08-13
• George0Papasotiriou/CVE-2026-9999-Serverless-Event-Injection-to-Code-Overwrite0★ · 2026-08-03

References

• CVE Record
• NVD entry

Related

• CVE-2026-9998
• CVE-2026-9997
• CVE-2026-9973
• CVE-2026-9848
• CVE-2026-9833
• CVE-2026-9830