CVE-2026-9901: Use after free in ANGLE in Google Chrome prior to 148

Synopsis

Use-after-free in ANGLE (Chrome's graphics abstraction layer) in Google Chrome versions prior to 148.0.7778.216. The vulnerability is reachable over the network, requires no authentication, but does require a victim to interact with a crafted HTML page, and is exploitable only by an attacker who has already compromised the Chrome renderer process. Successful exploitation allows the attacker to execute arbitrary code in the context of the browser process. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credentials on the target system are needed to deliver the malicious page.

• Victim interactionRequired

  The victim must open a crafted HTML page, making this a social-engineering-dependent attack that requires the user to visit or be redirected to attacker-controlled content.

• Attack complexityDetail

  Exploitation is rated High complexity because it requires a prior renderer process compromise as a precondition, introducing a significant multi-stage dependency before this vulnerability can be reached.

Blast Radius

• An attacker gains arbitrary code execution in the browser process, able to run any instructions with the privileges of the Chrome process on the victim host.
• Confidential data accessible to the browser (stored credentials, session tokens, browsing history, local files reachable by Chrome) is exposed to the attacker.
• The attacker can write or modify data accessible to the browser process, including cached content and files within Chrome's working directories.
• The browser process can be crashed or made unresponsive, disrupting the user's session and any dependent browser-based workflows.