CVE-2026-9974: Out of bounds write in GPU in Google Chrome prior to 148

Synopsis

An out-of-bounds write vulnerability in the GPU component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox by delivering a crafted HTML page. The attack requires network reachability, no authentication, victim interaction (opening a page), and a high-complexity precondition (prior renderer compromise). Successful exploitation gives the attacker full code execution outside the browser sandbox, with high impact on confidentiality, integrity, and availability. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, typically by serving a crafted HTML page from a remote host.

• AuthenticationNot required

  No account or credential is needed; the attack can be launched against any user who browses to a malicious page.

• Victim interactionRequired

  The victim must open or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Exploitation is rated high complexity because it requires the attacker to have already compromised the Chrome renderer process before the GPU out-of-bounds write can be used for sandbox escape.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code at the privilege level of the browser process on the victim host.
• Full read access to files and secrets accessible to the browser user account, including stored credentials, cookies, and session tokens.
• Attacker can write or modify files on the host filesystem within the browser user's permission scope.
• The host process can be crashed or made unstable, causing a denial of service for the affected user session.