CVE-2026-9924: Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 148

Synopsis

A heap buffer overflow in ANGLE, the graphics abstraction layer used by Google Chrome on Windows, allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox. The vulnerability is reachable over the network but requires the victim to visit a crafted HTML page, and no credentials are needed. Successful exploitation gives the attacker code execution outside the sandbox, effectively breaking the primary security boundary between a web page and the underlying Windows host. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable in a browsing context exposed to attacker-controlled content.

• AuthenticationNot required

  No credentials or account privileges are needed; the attacker only requires the ability to serve or link to a malicious page.

• Victim interactionRequired

  The victim must navigate to or load the crafted HTML page, making this a social-engineering-dependent exploit that requires at least one user action.

• Attack complexityDetail

  Exploit reliability is reduced by high complexity conditions: the attacker must already have compromised the renderer process before leveraging the heap overflow, introducing a two-stage prerequisite rather than a single-step attack.

Blast Radius

• The attacker escapes the Chrome sandbox on the Windows host, gaining code execution in the context of the browser process outside its normal confinement.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and locally cached files, becomes readable.
• The attacker can write or modify files and registry entries accessible to the browser process user account.
• The affected Chrome process and dependent browser functionality can be crashed or destabilized, causing service disruption for the end user.