CVE-2026-9999 — Chrome ANGLE/Metal WebGL PoC Hunting Harness (macOS)

---

1. Vulnerability summary

Field	Value
CVE	CVE-2026-9999
Vendor / product	Google Chrome
Affected	Chrome < 148.0.7778.216, macOS only [1]
Fixed in	148.0.7778.216 [1]
Impact	Arbitrary code execution inside a sandbox via a crafted HTML page [1]
Chromium severity	High [1]
CVSS 3.1 (CISA-ADP)	8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [1]
NVD (NIST) CVSS assessment	Not yet provided [1]
CWE	CWE-269 — Improper Privilege Management (enrichment by CISA-ADP) [1]
CISA SSVC (2026-05-29)	exploitation: none, automatable: no, technicalImpact: total [1]
Published / last modified	2026-05-28 / 2026-07-21 [1]
Root cause	Not public — Chromium issue 513364480 shows "Permissions Required" [1]

Attack chain implication: code execution "inside a sandbox" [1] means an attacker gaining control of a sandboxed process (most plausibly the GPU process). A full browser takeover would additionally require a separate sandbox escape that is not part of this CVE.

---

2. Strategy and hypothesis (analyst's own assessment — treat as unconfirmed)

The following is inference from the public record, not confirmed facts:

• ANGLE is the engine Chrome uses to translate WebGL GLSL to platform graphics APIs — on macOS, to Metal. A "crafted HTML page" [1] reaching ANGLE almost certainly means WebGL content — i.e., attacker-controlled shaders and/or WebGL state handled by the Metal backend.
• CWE-269 (Improper Privilege Management) [1] combined with sandbox-contained impact suggests the ANGLE/GPU layer failing to properly constrain something attacker-controlled during shader translation or state validation.
• Historically, this component has produced memory-safety bugs via edge cases in the GLSL translator (OOB constant indexing, integer-overflow array sizing, swizzle/discard interactions, oversized uniform blocks, loop-unrolling blowups).

The harness therefore exercises exactly those patterns and then mutates GLSL at scale to hunt for a renderer-side crash (WebGL context lost = GPU process crash or watchdog kill).

---

3. Repository contents

File	Purpose
cve-2026-9999-poc.html	Self-contained PoC harness (no dependencies): build fingerprinting, 8 curated translator-stress shaders, GLSL fuzzer with crash artifact capture
README.md	This file

---

4. Requirements

• A macOS machine or Metal-capable VM you are authorized to deliberately crash. The CVE is macOS-specific [1]; testing on Windows/Linux will not exercise the vulnerable ANGLE Metal backend.
• Chrome build < 148.0.7778.216 [1] (see §5).
• Hardware GPU / Metal support. Without it, Chrome falls back to SwiftShader (software rendering) and the vulnerable path is never reached — see §5.4 check.
• Python 3 (optional, only for the version-lookup helper in §5.1 and a local HTTP server).

---

5. Environment setup

5.1 Method A — Chrome for Testing (recommended)

Google's Chrome for Testing archive provides version-pinned builds that do not auto-update. Find the newest vulnerable build (everything below 148.0.7778.216 is affected [1]):

import json, urllib.request
data = json.load(urllib.request.urlopen(
  "https://googlechromelabs.github.io/chrome-for-testing/known-good-versions-with-downloads.json"))
key = lambda v: tuple(int(x) for x in v.split('.'))
fix = (148, 0, 7778, 216)
cands = sorted((v["version"] for v in data["versions"]
                if "chrome" in v.get("downloads", {}) and key(v["version"]) < fix), key=key)
print(cands[-5:])   # pick the last (newest vulnerable) entry

Download for your architecture (uname -m):

# Apple Silicon
https://storage.googleapis.com/chrome-for-testing-public/<VERSION>/mac-arm64/chrome-mac-arm64.zip
# Intel
https://storage.googleapis.com/chrome-for-testing-public/<VERSION>/mac-x64/chrome-mac-x64.zip

Unzip into a lab folder (e.g. ~/lab/, not /Applications) and launch from there.

5.2 Method B — Chromium snapshots

If a specific build is missing from Chrome for Testing, use the Chromium snapshot archive (commondatastorage.googleapis.com/chromium-browser-snapshots/Mac/ for Intel, .../Mac_Arm/ for Apple Silicon), indexed by commit position — map the vulnerable version to a branch position via chromium-history, then pull the nearest snapshot. Snapshots also do not auto-update.

5.3 Block auto-updates (only if using a branded build from another source)

Kill the Keystone updater agents and block googleupdate.googleapis.com, or the test build will silently patch itself overnight. Not needed for Chrome for Testing builds.

5.4 Verify you are on the Metal backend (critical)

Without Metal, Chrome renders WebGL in software (SwiftShader) and the ANGLE Metal backend is never touched. In the PoC page's console, run:

const c = document.createElement('canvas'), g = c.getContext('webgl2');
const x = g.getExtension('WEBGL_debug_renderer_info');
console.log(g.getParameter(x.UNMASKED_RENDERER_WEBGL));
// Good:  contains "ANGLE Metal Renderer"
// Bad:   contains "SwiftShader" -> the vulnerable path is NOT being exercised

You can also confirm at chrome://gpu. Parallels/VMware Fusion guests with GPU virtualization usually work; minimal QEMU/UTM setups often fall back to SwiftShader.

---

6. Steps to reproduce

1. Isolate the target. VM snapshot or dedicated macOS account. Never sign in or enable sync in the vulnerable build; treat it as compromised by design. (The CVE's impact is code execution inside a sandbox arriving simply by visiting a web page [1].)
2. Install the vulnerable build per §5 and verify §5.4 passes.
3. Serve the PoC (either open the file directly or):

   cd <repo dir>
   python3 -m http.server 8000
   # then browse to http://localhost:8000/cve-2026-9999-poc.html
   

4. Check the fingerprint line printed on load. It should report the build as below 148.0.7778.216 and therefore potentially vulnerable [1]. On patched builds the harness warns so you don't waste cycles.
5. Click 1) Run curated triggers. Eight shaders stress the translator patterns described in §2 (OOB constant indexing, integer-overflow array sizing, dynamic matrix indexing, loop-unroll stress, arrays-of-arrays, discard/swizzle, preprocessor edges, oversized UBOs). Watch for [!!] results and context-loss events.
6. Click 2) Fuzz. Mutated GLSL shaders are compiled, linked, drawn to, and read back in a loop. Watch the log for CONTEXT LOST.
7. On a crash, the offending shader is persisted to localStorage. Retrieve it:

   localStorage.getItem("cve20269999_poc_fs");      // crashing fragment shader
   localStorage.getItem("cve20269999_crashes");     // crash event log
   

8. Minimize and re-test the crashing shader in isolation (5+ consecutive runs) to confirm determinism.
9. Confirm root cause with an ASAN build before attributing anything to CVE-2026-9999 — see §8.

Live snapshot of a suspicious run is also visible at chrome://gpu and in macOS Console (GPU process crash reports).

---

7. Interpreting results / known false positives