CVE-2026-9946: Use after free in ANGLE in Google Chrome prior to 148

Synopsis

Use-after-free in ANGLE (the graphics abstraction layer inside Google Chrome) affects all Chrome versions before 148.0.7778.216. The vulnerability is reachable over the network and requires no credentials, but it does require the attacker to have already compromised the renderer process and to trick a user into visiting a crafted HTML page. Successful exploitation enables a full sandbox escape, giving the attacker high-confidence access to confidential data, the ability to tamper with system state, and the ability to crash or destabilize the browser. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by delivering a crafted HTML page, making this an over-the-network exposure.

• AuthenticationNot required

  No credentials or account access are needed; the attack is available to any remote party who can serve content to the target.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, requiring a social-engineering or malicious-link step.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must also have an already-compromised renderer process in place before the sandbox-escape primitive is reachable.

Blast Radius

• A successful attacker escapes the Chrome sandbox and gains execution context outside the browser's process isolation boundary.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and browsing history, becomes readable.
• The attacker can modify files, registry entries, or other persisted state on the host that the browser user account has write access to.
• The attacker can crash or hang Chrome and any dependent services, causing service disruption for the affected user session.