CVE-2026-9900: Out of bounds write in ANGLE in Google Chrome prior to 148

Synopsis

An out-of-bounds write vulnerability exists in ANGLE, the graphics-layer translation library embedded in Google Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network but requires the attacker to have already compromised the Chrome renderer process and to trick a user into visiting a crafted HTML page; no authentication is needed. Successful exploitation enables a sandbox escape, giving the attacker code execution outside the browser sandbox with access to confidential data, the ability to tamper with system state, and the ability to disrupt service. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page served from a remote host.

• AuthenticationNot required

  No account or credentials are needed; the attack is initiated from an unauthenticated network position.

• Victim interactionRequired

  A user must visit or be redirected to the attacker-controlled HTML page, making social engineering or malicious ad injection the likely delivery mechanism.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must already have compromised the Chrome renderer process before the out-of-bounds write can be used for a sandbox escape, introducing a prerequisite chained step.

Blast Radius

• Reads memory outside the intended buffer, exposing sensitive in-process data such as credentials, session tokens, or page content from other origins.
• Writes attacker-controlled data outside bounds, allowing modification of memory structures and enabling code execution outside the Chrome sandbox.
• Crashes the affected Chrome process if exploit conditions are not precisely met, causing a denial of service for the browser session.
• Once sandbox escape is achieved, the attacker operates with the privileges of the browser process on the host, enabling access to local files and system resources.