Executive brief
A vulnerability in Google Chrome's graphics translation engine (ANGLE) could allow a malicious website to execute unauthorized code on a user's Mac. This occurs when a user visits a specially crafted HTML page, potentially leading to a full compromise of the browser's restricted environment. While the impact is limited by the browser's security sandbox, it represents a significant risk to data privacy and system integrity for users on macOS.
Technical details
An improper input validation vulnerability (CWE-20) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome for macOS. The flaw is triggered when the browser processes untrusted input from a maliciously crafted HTML page. A remote, unauthenticated attacker can exploit this to achieve arbitrary code execution (ACE) within the Chromium sandbox. The vulnerability was addressed in version 147.0.7727.55. Although Chromium developers rated the severity as Medium, external assessments (CISA-ADP) have assigned it a High severity score of 8.8 due to the potential for code execution.
Affected products
- Google Chrome prior to 147.0.7727.55
Timeline
- 2023-10-01: other: Vulnerability reported to Chrome by parkminchan of SSD Labs Korea
- 2026-04-07: patched: Chrome 147.0.7727.55 released to stable channel
- 2026-04-08: disclosed: CVE published