CVE-2026-9940: Heap buffer overflow in ANGLE in Google Chrome prior to 148

Synopsis

A heap buffer overflow affects the ANGLE graphics layer in Google Chrome versions prior to 148.0.7778.216. The vulnerability is reachable over the network and requires no authentication, but does require a user to visit a crafted HTML page. Successful exploitation gives an attacker full read, write, and availability impact on the affected process, enabling data theft, content tampering, or a crash. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the target to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credential is needed; the attacker interacts with the browser as an anonymous remote party.

• Victim interactionRequired

  The target user must navigate to or be redirected to the attacker-controlled HTML page for the overflow to trigger.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the victim loads the page; no race condition or special memory layout is required.

Blast Radius

• Reads process memory accessible to the Chrome renderer, exposing session tokens, cached credentials, or in-memory page content.
• Writes arbitrary data into heap memory, allowing an attacker to corrupt renderer state or pivot toward code execution within the sandboxed process.
• Crashes the affected Chrome renderer process, causing an immediate denial of service for the browsing session.
• Combined high confidentiality, integrity, and availability impact means a single successful exploit can simultaneously exfiltrate data, tamper with rendered content, and terminate the process.