CVE-2026-9879: Out of bounds write in ANGLE in Google Chrome prior to 148

Synopsis

An out-of-bounds write vulnerability exists in ANGLE, the graphics translation layer used by Google Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, though a victim must visit a crafted HTML page for exploitation to occur. Successful exploitation gives an attacker arbitrary code execution in the context of the browser process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential is needed on the target system; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must open a crafted HTML page in an affected Chrome browser, making this a social-engineering or drive-by-browsing scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Attacker executes arbitrary code in the browser process, gaining full control over the browser's execution context.
• Attacker reads browser-accessible data including stored session tokens, saved credentials, and page content from any open origin.
• Attacker modifies browser state, injecting content or altering data handled by the renderer and browser process.
• Attacker crashes or destabilizes the browser process, causing a denial of service for the affected user session.