CVE-2026-9899: Use after free in ANGLE in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability exists in ANGLE, the graphics abstraction layer used by Google Chrome prior to version 148.0.7778.216. The flaw is reachable over the network, requires no authentication, but does require a victim to visit a crafted HTML page, and is harder to exploit reliably due to high attack complexity. An attacker who has already compromised the Chrome renderer process can exploit this flaw to escape the browser sandbox, gaining full confidentiality, integrity, and availability impact on the host. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credentials are needed; the attack is launched against any user who visits the malicious page.

• Victim interactionRequired

  The victim must actively open or be redirected to a crafted HTML page, making social engineering or a malicious ad a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must have already compromised the Chrome renderer process before this flaw can be used to escape the sandbox, introducing a significant prerequisite.

Blast Radius

• A successful exploit escapes the Chrome sandbox, giving the attacker code execution outside the browser's restricted process.
• The attacker reads sensitive data accessible to the browser process, including stored credentials, cookies, and session tokens.
• The attacker writes or modifies files and data accessible to the compromised user account on the host system.
• The attacker can crash or destabilize the host process, disrupting the affected service or user session.