CVE-2026-9982: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148

Synopsis

Insufficient input validation in the ANGLE graphics layer of Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox. The exploit is reachable over the network but requires the victim to visit a crafted HTML page, and the attacker must already control the renderer, making this a chained attack. Successful exploitation gives the attacker full code execution outside the Chrome sandbox, with high impact on confidentiality, integrity, and availability. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target must be reachable via a browser that loads the crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential is needed; the attacker simply serves a malicious page to any Chrome user running a vulnerable version.

• Victim interactionRequired

  The victim must visit the attacker-controlled HTML page in Chrome, making social engineering or a malicious ad/link a required step in the attack chain.

• Attack complexityDetail

  Attack complexity is High because the attacker must first have compromised the Chrome renderer process as a prerequisite before this vulnerability can be used to escape the sandbox.

Blast Radius

• Attacker breaks out of the Chrome browser sandbox, gaining arbitrary code execution at the privilege level of the Chrome process on the host OS.
• Files, credentials, and secrets accessible to the OS user running Chrome can be read directly.
• The attacker can write or modify files on the host, enabling persistence mechanisms such as dropped binaries or modified startup entries.
• The host process can be terminated or destabilized, causing a full browser or system crash.