CVE-2026-9877: Use after free in ANGLE in Google Chrome prior to 148

Synopsis

Use-after-free in the ANGLE graphics layer of Google Chrome prior to version 148.0.7778.216 allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox. The vulnerability is reachable over the network and requires no authentication, though victim interaction and a pre-compromised renderer are both prerequisites. Successful exploitation gives the attacker full code execution outside the sandbox, enabling high-impact compromise of confidentiality, integrity, and availability on the host. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers a crafted HTML page over the network, so the affected Chrome instance must be reachable or browsing to an attacker-controlled resource.

• AuthenticationNot required

  No account or credential is needed; any user browsing to the crafted page is a viable target.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making a social-engineering or malicious-ad delivery vector necessary.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must first achieve a separate renderer-process compromise before this use-after-free can be leveraged for a sandbox escape.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code in the context of the browser process on the host.
• With sandbox escape achieved, the attacker reads files and credentials accessible to the user running Chrome, including stored session tokens and local secrets.
• The attacker writes or modifies files on the host filesystem within the user's permissions, enabling persistence mechanisms or data tampering.
• The attacker can crash or destabilize the host-level browser process, causing service disruption for the affected user.