CVE-2026-9916: Out of bounds write in ANGLE in Google Chrome prior to 148

Synopsis

An out-of-bounds write vulnerability exists in ANGLE, the graphics translation layer used by Google Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network but requires the attacker to have already compromised the Chrome renderer process and to trick a user into visiting a crafted HTML page; successful exploitation enables a sandbox escape, granting the attacker capabilities beyond the browser's isolation boundary. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target host must be reachable and the user must browse to the attacker-controlled content.

• AuthenticationNot required

  No account or credential on the target system is needed; the attack is launched from an unauthenticated remote position.

• Victim interactionRequired

  The user must visit a crafted HTML page, meaning the attacker relies on social engineering or a malicious link to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is High, meaning the attacker must have first achieved a separate renderer-process compromise before this out-of-bounds write can be used for sandbox escape.

Blast Radius

• Attacker writes data outside intended buffer bounds inside the ANGLE graphics layer, enabling control over memory that crosses the renderer sandbox boundary.
• A successful sandbox escape lets the attacker execute code with the privileges of the browser process on the host, outside Chrome's isolation constraints.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and files the browser can read, becomes readable by the attacker.
• The attacker can modify or delete files and data accessible to the browser process, and can disrupt or crash the browser or dependent services.