Out of bounds write in Skia in Google Chrome on Mac prior to 149

CVE-2026-10925 is an out-of-bounds write in Chrome's Skia graphics stack on macOS. Affected builds are Google Chrome on Mac prior to 149.0.7827.53 per the CVE text, with Google's stable release shipping 149.0.7827.53/54 for Windows and Mac on June 2, 2026. The important nuance is the attacker is not starting from the open web alone; they already need code execution or equivalent control in the Chrome renderer process and then use a crafted HTML page to drive the bug.

Google's HIGH 8.3 is defensible as a raw technical score for memory corruption in a ubiquitous browser, but it overstates operational urgency for enterprise patch triage. The renderer-compromise prerequisite is a massive real-world friction point, macOS-only scope cuts the population again, and there is no KEV listing, no public exploit chain, and a very low provided EPSS score.

Why this verdict

• Start from 8.3, then subtract hard for the prerequisite: the attacker must already control the renderer process, which makes this post-compromise chain material rather than initial access.
• Mac-only scope narrows the blast radius: this is not a fleet-wide Chrome emergency unless your browser estate is heavily macOS-weighted.
• Threat intel is quiet: no KEV listing, no public PoC identified, and the provided EPSS (0.00068) is extremely low for a browser issue.

Why not higher?

If this were a one-click or zero-click remote path from a malicious page directly to browser compromise, it would stay in HIGH and potentially push higher with active exploitation. But the renderer-compromise dependency is not a footnote; it is the whole story, because it means the attacker already needs a separate serious bug or foothold first.

Why not lower?

This is still memory corruption in a massively deployed browser component, and successful chaining could materially raise attacker capability on managed Macs. Browsers also sit on sessions, tokens, and sensitive data, so even second-stage browser bugs deserve real patch ownership rather than backlog neglect.

1. Enforce rapid Chrome auto-update on managed Macs — Use MDM or enterprise browser policy to keep Chrome current and prevent long-lived vulnerable builds. For a MEDIUM verdict there is no noisgate mitigation SLA; use this as standard hardening while you work toward patch completion within the 365-day remediation window.
2. Harden extension install paths — Restrict extension sources, require allowlisting, and block developer-mode or unsigned installs where policy allows. That matters because a malicious or compromised extension is one plausible way to satisfy the renderer-compromise prerequisite; again, there is no mitigation SLA here, but this is worth rolling into normal browser hardening.
3. Keep Site Isolation and default sandbox protections enabled — Do not weaken Chrome security settings or deploy flags that reduce process isolation. These controls directly increase exploit-chain friction and are especially valuable against vulnerabilities that are only useful *after* renderer compromise.
4. Use version-based exposure reporting from MDM or EDR — Track Google Chrome.app version on macOS endpoints and alert on anything below 149.0.7827.53. This is the practical way to measure exposure because internet scanners cannot see local browser versions.

Run this on the target Mac endpoint locally or through MDM remote shell. Invoke it as bash check_chrome_cve_2026_10925.sh with standard user rights; root is not required because it only reads Chrome app metadata from /Applications.

#!/bin/bash
# check_chrome_cve_2026_10925.sh
# Detects exposure to CVE-2026-10925 on macOS by checking installed Google Chrome version.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

APP="/Applications/Google Chrome.app"
PLIST="$APP/Contents/Info.plist"
FIXED_VERSION="149.0.7827.53"

verlte() {
  [ "$1" = "$2" ] && return 0
  local IFS=.
  local i
  local -a va=($1) vb=($2)
  local len=${#va[@]}
  if [ ${#vb[@]} -gt $len ]; then
    len=${#vb[@]}
  fi
  for ((i=0; i<len; i++)); do
    local a=${va[i]:-0}
    local b=${vb[i]:-0}
    if ((10#$a < 10#$b)); then
      return 0
    fi
    if ((10#$a > 10#$b)); then
      return 1
    fi
  done
  return 0
}

if [ "$(uname -s)" != "Darwin" ]; then
  echo "UNKNOWN: This check is intended for macOS targets only."
  exit 2
fi

if [ ! -d "$APP" ] || [ ! -f "$PLIST" ]; then
  echo "UNKNOWN: Google Chrome not found at $APP"
  exit 2
fi

INSTALLED_VERSION=$(/usr/bin/defaults read "$PLIST" CFBundleShortVersionString 2>/dev/null || true)

if [ -z "$INSTALLED_VERSION" ]; then
  echo "UNKNOWN: Could not read Chrome version from $PLIST"
  exit 2
fi

if verlte "$INSTALLED_VERSION" "$FIXED_VERSION" && [ "$INSTALLED_VERSION" != "$FIXED_VERSION" ]; then
  echo "VULNERABLE: Google Chrome $INSTALLED_VERSION is older than fixed version $FIXED_VERSION"
  exit 1
fi

if [ "$INSTALLED_VERSION" = "$FIXED_VERSION" ]; then
  echo "PATCHED: Google Chrome $INSTALLED_VERSION matches fixed version $FIXED_VERSION"
  exit 0
fi

# Installed version is newer than the fixed version.
echo "PATCHED: Google Chrome $INSTALLED_VERSION is newer than fixed version $FIXED_VERSION"
exit 0

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Canadian Centre for Cyber Security - Google Chrome security advisory AV26-544
3. Chrome for Testing availability
4. Chromium Security
5. Chromium Site Isolation
6. FIRST EPSS
7. FIRST EPSS API documentation
8. CISA Known Exploited Vulnerabilities Catalog