Insufficient validation of untrusted input in WebShare in Google Chrome on Mac prior to 149

Based on the vendor title, this flaw sits in WebShare on macOS builds of Google Chrome before 149.0.7827.53. The important missing half of the sentence is the real attack precondition implied by the supplied CVSS and by closely analogous 2026 Chrome records: the attacker must already have *compromised the renderer process* and then use a crafted HTML page to drive the vulnerable code path. In plain English, this is not a one-bug drive-by from the open internet; it is the privilege-boundary break that turns a renderer foothold into a broader browser escape on Mac.

Google's HIGH 8.3 label is technically defensible in CVSS terms because a successful sandbox escape inside a browser exploit chain has major impact. Operationally, though, that score overstates Monday-morning urgency for most enterprises: it is Mac-only, needs user interaction, has high attack complexity, depends on a prior renderer compromise, and there is no KEV listing or exploitation signal in the sources reviewed. That combination pushes this down from 'drop everything' to 'important chained browser hardening.'

Why this verdict

• Renderer foothold required: the attack path implies the adversary already owns the renderer, which means this CVE is the *second bug in a chain* rather than the front door.
• Mac-only exposure: affected population is narrower than cross-platform Chrome bugs, especially in mixed Windows-heavy enterprises.
• High complexity plus user interaction: AC:H and UI:R are not theoretical here; they reflect real exploit reliability and delivery friction.
• No KEV / no exploitation signal: without active exploitation evidence, the vendor CVSS remains a worst-case impact score, not a threat-priority score.
• Still not low: if chained successfully, sandbox escape meaningfully increases blast radius on a user endpoint and can turn a renderer hit into real post-exploitation.

Why not higher?

A higher rating would fit a bug that is directly reachable by an unauthenticated remote attacker with no prior foothold, or one with credible active exploitation. This CVE fails both tests: it appears to require a prior renderer compromise and there is no reviewed evidence of weaponization in the wild.

Why not lower?

This is still a browser sandbox escape class issue inside a massively deployed application, and Chrome exploit chains are exactly how high-end operators bridge from web content to endpoint control. Even with friction, the impact of a working chain on a managed Mac is too meaningful to dismiss as backlog-only hygiene.

1. Enforce rapid Chrome auto-update on managed Macs — Use Chrome enterprise policy and your Mac management stack to minimize patch lag and keep desktop Chrome relaunching into current builds. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice browsers should not sit unpatched anywhere near that long.
2. Reduce arbitrary browsing from privileged Mac users — Move admins, developers with production access, and high-value users to tighter browsing policies, separate profiles, or browser isolation where feasible. This shrinks the odds that a renderer bug can be paired with this follow-on escape; for MEDIUM, there is no mitigation SLA, so apply this where risk concentration is highest rather than as a fleet-wide emergency.
3. Hunt for suspicious Chrome child-process behavior — Tune EDR detections for Google Chrome spawning shells, installers, script interpreters, or unusual persistence artifacts on macOS. This does not stop the bug itself, but it is the practical containment point after a successful escape; again, no mitigation SLA applies for this severity.
4. Inventory Mac Chrome versions from management telemetry — Use Google Admin, MDM, or EDR software inventory to identify Macs still below 149.0.7827.53. For a MEDIUM verdict, focus on verification and cleanup within the normal remediation program rather than emergency change windows.

Run this on the target Mac endpoint or through your MDM/remote shell. Invoke it as bash chrome_cve_2026_10920_check.sh with standard user privileges; it reads the installed Chrome app version and compares it to the fixed build 149.0.7827.53.

#!/bin/bash
# chrome_cve_2026_10920_check.sh
# Checks whether Google Chrome on macOS is vulnerable to CVE-2026-10920
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

APP_PATHS=(
  "/Applications/Google Chrome.app"
  "$HOME/Applications/Google Chrome.app"
)
FIXED_VERSION="149.0.7827.53"
FOUND_APP=""
INSTALLED_VERSION=""

version_to_list() {
  local IFS=.
  read -r -a parts <<< "$1"
  for i in 0 1 2 3; do
    echo -n "${parts[$i]:-0} "
  done
}

version_ge() {
  local a b i
  read -r -a a <<< "$(version_to_list "$1")"
  read -r -a b <<< "$(version_to_list "$2")"
  for i in 0 1 2 3; do
    if (( a[$i] > b[$i] )); then
      return 0
    elif (( a[$i] < b[$i] )); then
      return 1
    fi
  done
  return 0
}

for p in "${APP_PATHS[@]}"; do
  if [[ -d "$p" ]]; then
    FOUND_APP="$p"
    break
  fi
done

if [[ -z "$FOUND_APP" ]]; then
  echo "UNKNOWN: Google Chrome.app not found in standard macOS application paths"
  exit 2
fi

PLIST="$FOUND_APP/Contents/Info.plist"
if [[ ! -f "$PLIST" ]]; then
  echo "UNKNOWN: Info.plist not found at $PLIST"
  exit 2
fi

INSTALLED_VERSION=$(/usr/bin/defaults read "$PLIST" KSVersion 2>/dev/null || true)
if [[ -z "$INSTALLED_VERSION" ]]; then
  INSTALLED_VERSION=$(/usr/bin/defaults read "$PLIST" CFBundleShortVersionString 2>/dev/null || true)
fi

if [[ -z "$INSTALLED_VERSION" ]]; then
  echo "UNKNOWN: Could not determine installed Chrome version"
  exit 2
fi

if version_ge "$INSTALLED_VERSION" "$FIXED_VERSION"; then
  echo "PATCHED: Google Chrome $INSTALLED_VERSION (fixed version is $FIXED_VERSION)"
  exit 0
else
  echo "VULNERABLE: Google Chrome $INSTALLED_VERSION (fixed version is $FIXED_VERSION)"
  exit 1
fi

Sources

1. Chrome Releases - Early Stable Update for Desktop
2. Canadian Centre for Cyber Security AV26-544
3. NVD - CVE-2026-7967
4. NVD - CVE-2026-10000
5. NVD - CVE-2026-8517
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS API
8. Google Chrome Help - Update Google Chrome