CVE-2026-9966: Integer overflow in XML in Google Chrome on Windows prior to 148

Synopsis

An integer overflow in the XML parsing component of Google Chrome on Windows (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox via a crafted HTML page. The attack requires network access, no prior authentication, but does require the victim to visit a malicious page; it also requires the attacker to first have compromised the renderer, raising the practical bar. Successful exploitation gives the attacker code execution outside the sandbox, effectively breaking Chrome's primary isolation boundary. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the service (the victim's browser session) must be reachable or the victim must navigate to an attacker-controlled URL.

• AuthenticationNot required

  No account or credential is needed; the attacker operates as an anonymous remote party.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making a social-engineering or drive-by delivery step necessary.

• Attack complexityDetail

  Attack complexity is rated High because the attacker must first compromise the Chrome renderer process before the integer overflow can be used for a sandbox escape, introducing a prerequisite exploitation step that is not guaranteed to succeed reliably.

Blast Radius

• Breaks Chrome's sandbox on Windows, giving the attacker code execution in the context of the browser process outside the renderer jail.
• Reads files, credentials, and session data accessible to the Windows user account running Chrome.
• Writes or modifies files on the host filesystem under that user's permissions, enabling persistence or payload staging.
• Crashes or destabilizes the browser process, causing a denial of service for the affected session.