CVE-2026-9969: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148

Synopsis

Insufficient input validation in ANGLE, the graphics abstraction layer used by Google Chrome, allows a remote attacker to execute arbitrary code. The vulnerability is reachable over the network and requires no authentication, though the victim must visit a crafted HTML page. Successful exploitation gives the attacker full code execution in the context of the browser process, enabling data theft, tampering, or further system compromise. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential is needed on the targeted system; the attacker operates as an anonymous remote party.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Exploit complexity is low, meaning no race conditions or special environmental factors are required and exploitation is reliable when the victim loads the page.

Blast Radius

• The attacker executes arbitrary code in the Chrome browser process, gaining the same privileges as the running browser instance.
• Confidential data accessible to the browser, including session tokens, saved credentials, and locally cached files, is exposed to the attacker.
• The attacker can write or modify data within the browser's storage and any files the browser process has write access to.
• The browser process can be crashed or kept under attacker control, disrupting the user's session and any dependent services.