Attack chain implication: code execution "inside a sandbox" [1] means an attacker gaining control of a sandboxed process (most plausibly the GPU process). A full browser takeover would additionally require a separate sandbox escape that is not part of this CVE.

2. Strategy and hypothesis (analyst's own assessment — treat as unconfirmed)

The following is inference from the public record, not confirmed facts:

• ANGLE is the engine Chrome uses to translate WebGL GLSL to platform graphics APIs — on macOS, to Metal. A "crafted HTML page" [1] reaching ANGLE almost certainly means WebGL content — i.e., attacker-controlled shaders and/or WebGL state handled by the Metal backend.
• CWE-269 (Improper Privilege Management) [1] combined with sandbox-contained impact suggests the ANGLE/GPU layer failing to properly constrain something attacker-controlled during shader translation or state validation.
• Historically, this component has produced memory-safety bugs via edge cases in the GLSL translator (OOB constant indexing, integer-overflow array sizing, swizzle/discard interactions, oversized uniform blocks, loop-unrolling blowups).

The harness therefore exercises exactly those patterns and then mutates GLSL at scale to hunt for a renderer-side crash (WebGL context lost = GPU process crash or watchdog kill).

3. Repository contents

4. Requirements

• A macOS machine or Metal-capable VM you are authorized to deliberately crash. The CVE is macOS-specific [1]; testing on Windows/Linux will not exercise the vulnerable ANGLE Metal backend.
• Chrome build < 148.0.7778.216 [1] (see §5).
• Hardware GPU / Metal support. Without it, Chrome falls back to SwiftShader (software rendering) and the vulnerable path is never reached — see §5.4 check.
• Python 3 (optional, only for the version-lookup helper in §5.1 and a local HTTP server).

5. Environment setup

5.1 Method A — Chrome for Testing (recommended)

Google's Chrome for Testing archive provides version-pinned builds that do not auto-update. Find the newest vulnerable build (everything below 148.0.7778.216 is affected [1]):

Download for your architecture (uname -m):

Unzip into a lab folder (e.g. ~/lab/, not /Applications) and launch from there.

5.2 Method B — Chromium snapshots

If a specific build is missing from Chrome for Testing, use the Chromium snapshot archive (commondatastorage.googleapis.com/chromium-browser-snapshots/Mac/ for Intel, .../Mac_Arm/ for Apple Silicon), indexed by commit position — map the vulnerable version to a branch position via chromium-history, then pull the nearest snapshot. Snapshots also do not auto-update.

5.3 Block auto-updates (only if using a branded build from another source)

Kill the Keystone updater agents and block googleupdate.googleapis.com, or the test build will silently patch itself overnight. Not needed for Chrome for Testing builds.

5.4 Verify you are on the Metal backend (critical)

Without Metal, Chrome renders WebGL in software (SwiftShader) and the ANGLE Metal backend is never touched. In the PoC page's console, run:

You can also confirm at chrome://gpu. Parallels/VMware Fusion guests with GPU virtualization usually work; minimal QEMU/UTM setups often fall back to SwiftShader.

6. Steps to reproduce

1. Isolate the target. VM snapshot or dedicated macOS account. Never sign in or enable sync in the vulnerable build; treat it as compromised by design. (The CVE's impact is code execution inside a sandbox arriving simply by visiting a web page [1].)
2. Install the vulnerable build per §5 and verify §5.4 passes.
3. Serve the PoC (either open the file directly or):
   root@kitploit:~

   cd <repo dir>
   python3 -m http.server 8000
   # then browse to http://localhost:8000/cve-2026-9999-poc.html
   

4. Check the fingerprint line printed on load. It should report the build as below 148.0.7778.216 and therefore potentially vulnerable [1]. On patched builds the harness warns so you don't waste cycles.
5. Click 1) Run curated triggers. Eight shaders stress the translator patterns described in §2 (OOB constant indexing, integer-overflow array sizing, dynamic matrix indexing, loop-unroll stress, arrays-of-arrays, discard/swizzle, preprocessor edges, oversized UBOs). Watch for [!!] results and context-loss events.
6. Click 2) Fuzz. Mutated GLSL shaders are compiled, linked, drawn to, and read back in a loop. Watch the log for CONTEXT LOST.
7. On a crash, the offending shader is persisted to localStorage. Retrieve it:
   root@kitploit:~

   localStorage.getItem("cve20269999_poc_fs");      // crashing fragment shader
   localStorage.getItem("cve20269999_crashes");     // crash event log
   

8. Minimize and re-test the crashing shader in isolation (5+ consecutive runs) to confirm determinism.
9. Confirm root cause with an ASAN build before attributing anything to CVE-2026-9999 — see §8.

Live snapshot of a suspicious run is also visible at chrome://gpu and in macOS Console (GPU process crash reports).

7. Interpreting results / known false positives

• WEBGL_context_lost ≠ vulnerability. Chrome's GPU watchdog kills long-running shaders (the loop-unroll-dos trigger and fuzz iterations with huge loop counts are designed to be slow). Silence the noise: reduce SH_ITER, or confirm any candidate crash reproduces quickly (< 1 s per iteration).
• A real memory-safety crash should reproduce deterministically from the minimized shader and show a distinct crash signature in Console (e.g., EXC_BAD_ACCESS) rather than a watchdog termination.
• Only an ASAN report pinpointing the ANGLE Metal backend is solid evidence you have found this bug as opposed to an unrelated driver hiccup.

8. Root-cause confirmation: ASAN build (optional but strongly recommended)

Build a vulnerable revision of Chromium with AddressSanitizer:

Then run the minimized crashing shader with Metal API validation enabled:

The ASAN trace will name the exact ANGLE/Metal function and confirm whether the crash matches the CVE's component [1]. (Downstream: once the fix commit for 148.0.7778.216 is visible, diff third_party/angle/src/libANGLE/renderer/metal/ to pinpoint the true root cause and replace the fuzzing approach with a deterministic trigger.)

9. Limitations

• No public root cause or PoC exists. The Chromium issue is restricted ("Permissions Required") [1]; this harness is hypothesis-driven.
• No known in-the-wild exploitation. CISA's SSVC enrichment (2026-05-29) records exploitation: none [1].
• Sandbox-contained impact only [1] — this PoC, even if it produces code execution, addresses only the sandboxed-process stage of a real attack chain.
• macOS-only target [1]; do not draw conclusions from runs on other platforms.

10. Safety & legal

Test only on machines you own or are explicitly authorized to test. The harness intentionally compiles adversarial shaders to crash a graphics process — expect GPU process kills. Keep the vulnerable browser build off production networks.

11. References

[1] NVD — CVE-2026-9999: https://nvd.nist.gov/vuln/detail/CVE-2026-9999 * Vendor advisory (Chrome Releases blog, Stable Channel update): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html * Chromium issue 513364480 (access-restricted): https://issues.chromium.org/issues/513364480