Out of bounds read in ANGLE in Google Chrome on Mac prior to 149

CVE-2026-10930 is an out-of-bounds read in Chrome's ANGLE graphics layer affecting Google Chrome on macOS before 149.0.7827.53. Public patch metadata ties the fix to ANGLE's Metal-backed Mac rendering path, which matters because this is a browser-driven bug reachable from a crafted HTML page, but only on the Mac slice of the fleet that hits the vulnerable graphics path.

Google tagged the bug High, but that overstates the operational urgency for most enterprises. This is a read-only memory disclosure, not code execution, not a sandbox escape, not a server-side bug, and not a proven in-the-wild exploit; once you account for Mac-only reachability, user interaction, and read-only impact, the real-world patch priority lands at MEDIUM.

Why this verdict

• Confidentiality-only impact pushes down hard: public facts support an out-of-bounds *read*, not write, not sandbox escape, not native code exec. That is meaningful, but it is a smaller blast radius than the average remotely reachable Chrome memory-corruption headline.
• Mac-only reachability narrows the exposed population: the bug is explicitly scoped to Chrome on macOS, and the upstream fix points at ANGLE's Metal path. In mixed fleets, this instantly shrinks the patch target set versus a whole-browser all-platform issue.
• User interaction is required: the attacker must get a user to render a crafted page. That implies this is pre-compromise only through browser lures, and modern email/web controls plus Safe Browsing apply downward pressure.
• Threat telemetry is cold: no KEV, no public PoC located, and EPSS 0.00035 all argue against treating this like an emergency patch item. That is not proof of safety, but it is absolutely reason to keep it out of the top tier.

Why not higher?

There is no public evidence of code execution, sandbox escape, or active exploitation. The attack path is further narrowed by Mac-only applicability and a technically specific ANGLE rendering condition, so calling this HIGH or CRITICAL would ignore too much real-world friction.

Why not lower?

It is still a remote, no-auth, browser-reachable bug in one of the most exposed applications in the enterprise. A crafted webpage that can leak process memory is not backlog dust, because browsers routinely hold credentials, tokens, and sensitive business content.

1. Force Chrome auto-update on managed Macs — Use MDM or Chrome Enterprise controls to push 149.0.7827.53 or later and force relaunch where policy allows. This is the cleanest control because MEDIUM has no noisgate mitigation SLA; go straight to durable remediation inside the 365-day window instead of building elaborate temporary controls.
2. Inventory and isolate the Mac slice — Scope the issue to macOS Chrome first so Windows and Linux teams do not burn cycles on the wrong population. Pull software inventory from MDM/EDR now and keep a live exception list until all Macs report compliant versions; again, no mitigation SLA applies for MEDIUM.
3. Reduce risky browser exposure for high-sensitivity Mac tiers — For admins, finance, and executive Macs that browse broadly, consider temporary hardening such as stricter URL filtering or disabling unneeded WebGL-heavy workflows if business impact is tolerable. Use this only as exposure reduction while the patch rolls out; there is no mitigation SLA — go straight to the remediation window.

Run this on the target Mac host or through your MDM/remote shell on macOS. Invoke it as bash check_cve_2026_10930.sh "/Applications/Google Chrome.app"; standard user rights are usually enough because it only reads the app bundle's version metadata.

#!/bin/bash
# check_cve_2026_10930.sh
# Detects whether Google Chrome on macOS is vulnerable to CVE-2026-10930
# Affected: Google Chrome on Mac prior to 149.0.7827.53
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

APP_PATH="${1:-/Applications/Google Chrome.app}"
FIXED_VERSION="149.0.7827.53"
PLIST="$APP_PATH/Contents/Info.plist"

get_version() {
  /usr/bin/defaults read "$PLIST" CFBundleShortVersionString 2>/dev/null
}

ver_lt() {
  # returns 0 if $1 < $2, else 1
  local IFS=.
  local i
  local -a a=($1) b=($2)
  local len=${#a[@]}
  if [ ${#b[@]} -gt $len ]; then
    len=${#b[@]}
  fi
  for ((i=0; i<len; i++)); do
    local ai=${a[i]:-0}
    local bi=${b[i]:-0}
    if ((10#$ai < 10#$bi)); then
      return 0
    elif ((10#$ai > 10#$bi)); then
      return 1
    fi
  done
  return 1
}

if [ ! -d "$APP_PATH" ]; then
  echo "UNKNOWN: Chrome app not found at $APP_PATH"
  exit 2
fi

if [ ! -f "$PLIST" ]; then
  echo "UNKNOWN: Info.plist not found at $PLIST"
  exit 2
fi

VERSION="$(get_version)"
if [ -z "$VERSION" ]; then
  echo "UNKNOWN: Could not determine Chrome version"
  exit 2
fi

if ver_lt "$VERSION" "$FIXED_VERSION"; then
  echo "VULNERABLE: Google Chrome $VERSION is older than fixed version $FIXED_VERSION"
  exit 1
else
  echo "PATCHED: Google Chrome $VERSION is at or newer than fixed version $FIXED_VERSION"
  exit 0
fi

Sources

1. Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
2. ANGLE fix commit tied to bug 500472605
3. Canadian Centre for Cyber Security advisory AV26-544
4. Chromium Security page
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation