CVE-2026-9910: Out of bounds memory access in ANGLE in Google Chrome prior to 148

Synopsis

Out-of-bounds memory access in the ANGLE graphics layer of Google Chrome (versions before 148.0.7778.216) allows a remote attacker to execute arbitrary code inside the Chrome sandbox. The attack is reachable over the network, requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives the attacker code execution within the browser sandbox, with full read, write, and availability impact on the affected process. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remote crafted HTML page, so the service must be reachable from an external network origin.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the victim to load a URL.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector that requires the user to click a link or be redirected.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other hard-to-control environmental factors.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control of that sandboxed process.
• Confidentiality impact is high: the attacker reads memory contents within the sandbox, which may include session tokens, cached credentials, or page data.
• Integrity impact is high: the attacker writes or corrupts memory within the process, enabling data tampering or staging of a sandbox-escape chain.
• Availability impact is high: the attacker can crash or destabilize the affected Chrome process, terminating the user session.