CVE-2026-9941: Use after free in ANGLE in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, only that the victim opens a malicious page. Successful exploitation gives the attacker code execution within the Chrome sandbox, which may serve as a stepping stone to a full browser escape. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by hosting a crafted HTML page that the victim's browser fetches remotely.

• AuthenticationNot required

  No account, credential, or prior session is needed; any user browsing to the malicious page is a valid target.

• Victim interactionRequired

  The victim must open or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• Attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control of the sandboxed process.
• Confidential data processed by the renderer, including page content, stored credentials surfaced by autofill, and session tokens, is readable by the attacker.
• The attacker can modify data within the sandboxed context, including intercepting or altering network requests issued by the page.
• Sandbox code execution is a recognized prerequisite for chained browser-escape exploits, making this a high-value initial foothold.