CVE-2026-9925: Use after free in ANGLE in Google Chrome prior to 148

Synopsis

Use-after-free in ANGLE (the graphics-layer translation library) in Google Chrome prior to version 148.0.7778.216. The vulnerability is reachable over the network, requires no authentication, but does require victim interaction and involves high attack complexity, derived from a CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:R/S:C. A remote attacker who has already compromised the Chrome renderer process can exploit this memory-safety flaw to escape the browser sandbox, gaining execution capability outside the renderer's restricted environment. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the Chrome instance must be reachable or browsing to attacker-controlled content.

• AuthenticationNot required

  No credentials or account are needed; the attack is launched by getting a user to visit a crafted page on the open web.

• Victim interactionRequired

  A user must open or be redirected to the attacker-crafted HTML page, making this a social-engineering or drive-by-browse scenario.

• Attack complexityDetail

  Attack complexity is HIGH, meaning the attacker must first achieve renderer-process compromise as a prerequisite before the use-after-free can be leveraged for sandbox escape, introducing environmental dependencies beyond simple payload delivery.

Blast Radius

• Attacker escapes the Chrome renderer sandbox, breaking out of the restricted process and into the broader host environment.
• Code runs with the privileges of the user account running Chrome, allowing reads of files, credentials, and session data accessible to that user.
• Attacker can write or modify files and data accessible to the user on the host, including persisted application data.
• The affected Chrome process and dependent browser services can be crashed or destabilized, causing loss of browser availability.