CVE-2026-9878: Use after free in ANGLE in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in ANGLE, the graphics abstraction layer bundled with Google Chrome, affects all Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network without any authentication; a remote attacker only needs the victim to open a crafted HTML page. Successful exploitation enables arbitrary code execution inside the Chrome sandbox, giving the attacker control over the renderer process with access to confidential data, the ability to tamper with page content, and the potential to destabilize the browser. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach or receive a crafted HTML page from an attacker-controlled origin.

• AuthenticationNot required

  No account or credentials are needed; the attack works against any unauthenticated browser session that loads the malicious page.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control of the sandboxed process.
• Session tokens, saved credentials, and any page content loaded in the affected tab are readable by the attacker.
• The attacker can modify rendered page content, intercept form submissions, and inject malicious scripts into the browsing context.
• The renderer process can be crashed or destabilized, disrupting the user's browser session.