CVE-2026-9927: Use after free in ANGLE in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome, allows a remote attacker to execute arbitrary code inside Chrome's sandbox by luring a victim to a crafted HTML page. The flaw is reachable over the network and requires no authentication, only a single user interaction (visiting a malicious page). Successful exploitation gives the attacker code execution within the Chrome renderer sandbox, which can be chained with a sandbox-escape to achieve full process compromise. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be able to reach attacker-controlled or compromised web content.

• AuthenticationNot required

  No account, credential, or prior access is needed; any anonymous user browsing the web is a valid target.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering or malvertising vector that requires one deliberate or tricked navigation action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental preconditions.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control over the renderer process.
• Confidentiality is fully compromised within the sandbox: the attacker reads DOM content, stored credentials surfaced by autofill, and any in-memory page data.
• Integrity is fully compromised within the sandbox: the attacker modifies page content, injects scripts, and manipulates network requests originating from the renderer.
• The affected Chrome renderer process can be crashed or destabilized, disrupting the user's browsing session for any open tab handled by that renderer.