CVE-2026-9928: Out of bounds read in ANGLE in Google Chrome on Windows prior to 148

Synopsis

An out-of-bounds read vulnerability in the ANGLE graphics layer of Google Chrome on Windows allows a remote attacker to execute arbitrary code. The attack is reachable over the network, requires no authentication, and is triggered when a user visits a crafted HTML page, meaning victim interaction is the only barrier. Successful exploitation gives the attacker full code execution in the context of the browser process, enabling data theft, system tampering, or further compromise. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page, so the targeted host must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated user who browses to the malicious page is a viable target.

• Victim interactionRequired

  The user must open a crafted HTML page in the browser, making this a social-engineering or malvertising vector that requires at least one click or redirect.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout randomization, or other environmental preconditions.

Blast Radius

• Attacker executes arbitrary code inside the Chrome browser process on the affected Windows host.
• Code execution at browser-process privilege allows reading of in-memory session tokens, saved credentials, and open tab content.
• The attacker can write or modify files accessible to the browser process, including cached data and user-profile storage.
• A compromised browser process can be used as a foothold to attempt privilege escalation or lateral movement within the host environment.