CVE-2026-9906: Out of bounds write in GPU in Google Chrome prior to 148

Synopsis

Out-of-bounds write in the GPU component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network but requires the victim to visit a specially crafted page, and exploitation is non-trivial due to the prerequisite of a compromised renderer. Successful exploitation grants the attacker code execution outside the browser sandbox, breaking a core containment boundary. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable via a browser session.

• AuthenticationNot required

  No authentication is required; the attacker needs no account or credentials on the target system to deliver the crafted page.

• Victim interactionRequired

  The victim must visit the attacker-controlled or crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Exploitation is rated High complexity because it requires the attacker to have already compromised the renderer process as a prerequisite, introducing a significant environmental dependency before the sandbox escape is possible.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox, gaining code execution in the context of the browser process outside normal containment.
• With sandbox escape achieved, the attacker reads files and credentials accessible to the browser process on the host, including stored session tokens and profile data.
• The attacker can write or modify files accessible to the browser process, enabling persistence mechanisms or tampering with locally stored data.
• The attacker can crash or destabilize the browser process, causing service disruption for the affected user session.