CVE-2026-9975: Out of bounds read and write in ANGLE in Google Chrome prior to 148

Synopsis

An out-of-bounds read and write vulnerability exists in ANGLE, the graphics abstraction layer embedded in Google Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, but does require an attacker to have already compromised the Chrome renderer process and to trick a user into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, granting the attacker code execution or data access outside the browser's sandboxed environment. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target over the network, as the attack is delivered via a crafted HTML page served remotely (CVSS AV:N).

• AuthenticationNot required

  No account or credential is needed to initiate the attack; the crafted page can be served to any unauthenticated browser session (CVSS PR:N).

• Victim interactionRequired

  The target user must visit the attacker-controlled or attacker-crafted HTML page for the exploit chain to proceed (CVSS UI:R).

• Attack complexityDetail

  Exploitation is rated High complexity (CVSS AC:H), meaning the attacker must already have compromised the Chrome renderer process before the out-of-bounds primitive can be used for a sandbox escape; this is a significant precondition beyond simply serving a malicious page.

Blast Radius

• A successful attacker escapes the Chrome sandbox and gains code execution in the context of the browser process on the host system.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and user profile data, can be read.
• The attacker can write to memory and file system locations accessible outside the sandbox, enabling tampering with persisted application data.
• The combination of high confidentiality, integrity, and availability impact (CVSS C:H/I:H/A:H) means the attacker can also crash or destabilize the affected process and any dependent services.