CVE-2026-9895: Out of bounds read in GPU in Google Chrome prior to 148

Synopsis

Out-of-bounds read in the GPU component of Google Chrome prior to version 148.0.7778.216. The vulnerability is reachable over the network but requires the attacker to have already compromised the renderer process and requires the victim to visit a crafted HTML page; no credentials are needed. Successful exploitation enables a sandbox escape, giving the attacker elevated access outside the Chrome renderer sandbox with high impact to confidentiality, integrity, and availability. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by delivering a crafted HTML page, making network exposure a prerequisite.

• AuthenticationNot required

  No credentials or account are needed; the attacker operates without any authentication to the target.

• Victim interactionRequired

  The victim must open a crafted HTML page in the browser, requiring a social-engineering step to direct the user to attacker-controlled content.

• Attack complexityDetail

  Exploitation is rated High complexity because it depends on the attacker having already compromised the renderer process, introducing a significant environmental precondition before the GPU out-of-bounds read can be leveraged.

Blast Radius

• Reads arbitrary memory outside the intended GPU buffer, which can expose sensitive in-process data including rendered page content and session material.
• Writes outside the intended buffer boundary, allowing the attacker to tamper with GPU process state or inject controlled data into adjacent memory regions.
• Escapes the Chrome renderer sandbox, breaking the primary isolation boundary and granting the attacker code execution with the privileges of the browser process on the host.
• Full compromise of confidentiality, integrity, and availability of the affected process, extending impact beyond the browser tab to the underlying host context.