CVE-2026-9880: Insufficient validation of untrusted input in WebGL in Google Chrome prior to 148

Synopsis

Insufficient input validation in the WebGL component of Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network, requires no authentication, but does need the victim to visit a malicious page, and the attacker must already control the renderer process, raising practical complexity. Successful exploitation gives the attacker full read, write, and availability impact outside the browser sandbox, effectively achieving code execution in the context of the host user. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable in the sense that the user browses to an attacker-controlled URL.

• AuthenticationNot required

  No account credentials or prior authentication are needed; any user browsing to the malicious page is a valid target.

• Victim interactionRequired

  The victim must open a crafted HTML page, meaning the attacker relies on social engineering or a malicious link to get the user to navigate there.

• Attack complexityDetail

  Attack complexity is rated High because the attacker must have already compromised the Chrome renderer process before this vulnerability can be used to escape the sandbox, introducing a significant prerequisite condition.

Blast Radius

• An attacker who escapes the sandbox reads files and data accessible to the host OS user running Chrome, including stored credentials, session data, and local documents.
• The attacker can write or modify files on the host filesystem within the permissions of that OS user, enabling persistence mechanisms or tampering with local data.
• The attacker can crash or disrupt the browser process and any dependent services running under the same user context.
• Because the scope changes (S:C in the CVSS vector), impact extends beyond the browser itself to other resources on the host system.