CVE-2026-9915: Heap buffer overflow in ANGLE in Google Chrome prior to 148

Synopsis

A heap buffer overflow in ANGLE, the graphics abstraction layer inside Google Chrome, affects all Chrome versions prior to 148.0.7778.216. The vulnerability is reachable over the network but requires the attacker to have already compromised the renderer process; a victim must also open a crafted HTML page. Successful exploitation allows the attacker to escape Chrome's sandbox, giving them full code execution on the host system with the ability to read, modify, or destroy data outside the browser process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted Chrome instance must be reachable or the victim must browse to an attacker-controlled URL.

• AuthenticationNot required

  No account or credential is needed; any user browsing to the crafted page is a viable target.

• Victim interactionRequired

  The victim must open a crafted HTML page, meaning the attacker must socially engineer the user into visiting a malicious URL or embedded frame.

• Attack complexityDetail

  Exploitation is rated High complexity because the attacker must have already compromised the renderer process before the heap overflow can be used for a sandbox escape, introducing a prerequisite exploitation stage.

Blast Radius

• The attacker breaks out of Chrome's sandbox and executes arbitrary code as the OS user running Chrome.
• Files, credentials, and secrets readable by that OS user become accessible to the attacker.
• The attacker can write or delete files on the host filesystem, including configuration, keys, and application data.
• The attacker can crash or destabilize host processes beyond the browser, disrupting services running under the same user context.