CVE-2026-9914: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148

Synopsis

Insufficient input validation in ANGLE (Almost Native Graphics Layer Engine), the graphics translation layer inside Google Chrome, allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network but requires the victim to visit an attacker-controlled page, and exploitation is complicated by the high-complexity CVSS rating and the prerequisite of a renderer compromise. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the sandbox, effectively breaking Chrome's primary isolation boundary. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the affected Chrome instance must be reachable and able to browse to an attacker-controlled URL.

• AuthenticationNot required

  No account or credential is required; any user who visits the malicious page is a viable target.

• Victim interactionRequired

  The victim must navigate to or be socially engineered into loading the attacker-crafted HTML page in their browser.

• Attack complexityDetail

  Exploitation is rated high complexity because it chains a renderer-process compromise as a prerequisite before the ANGLE input-validation flaw can be used to escape the sandbox.

Blast Radius

• Once the sandbox boundary is crossed, the attacker reads files, credentials, and session data accessible to the Chrome process on the host.
• The attacker writes or modifies files and data on the host system outside the sandbox, including user-profile data and potentially persistent storage.
• The attacker can terminate processes or consume host resources, disrupting the availability of the browser and other services on the machine.
• With code execution outside the sandbox, the attacker gains a foothold on the underlying host and can pivot to further compromise the local environment.