CVE-2026-9932: Use after free in ANGLE in Google Chrome on Windows prior to 148

Synopsis

A use-after-free vulnerability in the ANGLE graphics layer of Google Chrome on Windows allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox via a crafted HTML page. The attack requires the victim to visit a malicious page and benefits from no authentication requirement, though the attacker must first control the renderer, which elevates the overall complexity. Successful exploitation gives the attacker full code execution outside the Chrome sandbox, enabling reads, writes, and service disruption at the host OS level. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable in the sense that the victim can browse to an attacker-controlled URL.

• AuthenticationNot required

  No account or credential is required; the attacker only needs the victim to load a crafted page.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is high because the attacker must have already compromised the Chrome renderer process before this use-after-free can be leveraged for a sandbox escape, introducing a meaningful precondition.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code in the context of the browser process on the host Windows system.
• Confidential data accessible to the browser process (stored credentials, session tokens, local files) becomes readable.
• The attacker can write or modify files and registry entries accessible to the browser process user account.
• The host Chrome process can be crashed or used as a foothold for further lateral movement within the host OS.