CVE-2026-9970: Use after free in WebGL in Google Chrome prior to 148

Synopsis

Use-after-free in the WebGL component of Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox by luring a user to a crafted HTML page. The vulnerability is reachable over the network but requires user interaction and benefits from a pre-existing renderer compromise, raising the bar for exploitation while still enabling full confidentiality, integrity, and availability impact across the browser scope. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted browser must be able to reach an attacker-controlled web resource.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the victim to load a page.

• Victim interactionRequired

  A user must visit or be redirected to the crafted HTML page, making a social-engineering or malvertising step a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is HIGH because a successful sandbox escape requires the attacker to have already compromised the Chrome renderer process, adding a significant prerequisite condition beyond simply serving a malicious page.

Blast Radius

• A successful attacker escapes the Chrome sandbox, breaking the isolation boundary intended to contain renderer-level compromises.
• With sandbox escape achieved, the attacker gains read access to files and data outside the browser's sandboxed scope, including session tokens, locally stored credentials, and user files.
• The attacker can write or modify data on the host, including injecting files or altering application state outside the browser process.
• The attacker can crash or destabilize processes outside the sandbox, causing service disruption beyond the browser tab in which the exploit runs.