CVE-2026-9965: Out of bounds write in ANGLE in Google Chrome prior to 148

Synopsis

An out-of-bounds write vulnerability exists in ANGLE, the graphics abstraction layer bundled with Google Chrome versions prior to 148.0.7778.216. A remote attacker can reach it over the network without any account credentials, but must convince the target user to visit a crafted HTML page. Successful exploitation corrupts heap memory, giving the attacker the ability to read sensitive data, modify application state, and crash or take control of the affected process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by delivering a crafted HTML page via a standard web request.

• AuthenticationNot required

  No account credentials or prior authentication are needed to deliver the malicious page to the target.

• Victim interactionRequired

  The target user must open a crafted HTML page, requiring the attacker to socially engineer a click or redirect.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout preconditions.

Blast Radius

• A successful attacker reads contents of heap memory, which may include session tokens, credentials, or other sensitive browser state.
• A successful attacker writes arbitrary data into heap memory, allowing modification of internal Chrome or ANGLE data structures.
• The attacker can crash the affected Chrome renderer process, disrupting the user's session and any active web applications.
• In a full exploitation scenario, heap corruption at this severity level enables arbitrary code execution within the Chrome renderer sandbox.