CVE-2026-9904: Use after free in ANGLE in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability exists in ANGLE, the graphics translation layer bundled with Google Chrome prior to version 148.0.7778.216. The flaw is reachable over the network, requires no authentication, but does require the victim to load a crafted HTML page. Successful exploitation lets a remote attacker escape Chrome's sandbox, gaining code execution outside the browser's restricted process. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential is required; the attacker needs only to get the victim to load the malicious page.

• Victim interactionRequired

  The victim must actively open the crafted HTML page, making this a social-engineering vector (e.g., a phishing link or malicious ad).

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker likely depends on specific memory layout conditions or timing factors that are not fully under attacker control on every attempt.

Blast Radius

• A successful exploit escapes Chrome's sandbox, giving the attacker code execution in the context of the browser process on the victim's host.
• With sandbox escape, the attacker can read files and credentials accessible to the user running Chrome, including stored session tokens and profile data.
• The attacker can write or modify files on the host filesystem within the user's permission scope, enabling persistence or further lateral movement.
• The attacker can crash or disrupt the browser process and any dependent services running under the same user account.