CVE-2026-9967: Out of bounds write in GPU in Google Chrome prior to 148

Synopsis

An out-of-bounds write vulnerability in the GPU component of Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker to trigger a sandbox escape by luring a user to a crafted HTML page. The attack is reachable over the network, requires no authentication, but does require the victim to visit a malicious page. Successful exploitation gives the attacker full read, write, and execution capabilities outside the browser sandbox, enabling remote code execution on the host. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remotely hosted crafted HTML page.

• AuthenticationNot required

  No account or credential is needed on the target system; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled HTML page, making social engineering or malvertising the primary delivery vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• The attacker escapes the Chrome browser sandbox and gains code execution in the context of the host OS process.
• High confidentiality impact: the attacker reads files, credentials, session tokens, and other data accessible to the browser process and beyond.
• High integrity impact: the attacker writes to or modifies files, registry entries, or persistent storage outside the browser.
• High availability impact: the attacker can crash or terminate host-level processes, rendering the system or dependent services unavailable.