CVE-2026-9878: Critical Use-After-Free in Chrome ANGLE Graphics Library

Technical summary

CVE-2026-9878 is a use-after-free vulnerability (CWE-416) in ANGLE, Google's graphics abstraction layer used by Chrome for GPU acceleration. The flaw allows an attacker to trigger memory access after an object has been freed, leading to code execution within the Chrome sandbox context. The vulnerability is reachable via crafted HTML delivered through a remote website, requiring only that a user visit the malicious page. No special browser configuration or plugins are needed. The vulnerability affects multiple operating system deployments of Chrome, including Windows, macOS, and Linux.

Business impact

Organizations where employees use Chrome as their primary or supplementary browser face risk of data exfiltration or local system compromise if users visit attacker-controlled or compromised websites. While the sandbox limits direct OS-level impact, attackers can access sensitive browser data, cached credentials, or locally stored information. For organizations in regulated industries, any successful compromise could trigger incident response, forensics, and disclosure obligations. The attack surface is broad—users need only visit a malicious page—making this a material risk if patching is delayed.

Affected systems

Google Chrome on Windows, macOS, and Linux are directly vulnerable. The fix applies to Chrome version 148.0.7778.216 and later. Organizations should inventory Chrome deployments across endpoints and determine which versions are in use. This includes both managed corporate deployments and employee personal devices if they access company resources via Chrome. The vulnerability does not directly affect the operating systems themselves, though they remain attack vectors through browser compromise.

Exploitability

This vulnerability has a CVSS 3.1 score of 8.8 (HIGH) reflecting network accessibility, low attack complexity, and high impact on confidentiality, integrity, and availability. Exploitation requires user interaction—specifically, that a user visit a malicious website—but does not require social engineering beyond standard web traffic. The sandbox provides some containment, but research shows sandbox escapes are achievable in Chrome, and even sandbox-contained code can exfiltrate valuable data. The vulnerability has not yet been listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread active exploitation has been reported at this time.

Remediation

Update Google Chrome to version 148.0.7778.216 or later. Chrome auto-updates by default on most platforms, but organizations should verify that updates have deployed and confirm the running version via chrome://version. For managed environments, admins can push updates via group policy (Windows), configuration profiles (macOS), or Linux package managers. Organizations should prioritize this patch given the direct remote code execution risk, even if confined to the sandbox.

Patch guidance

Priority: Critical. Deploy Chrome 148.0.7778.216 or later across all endpoints. Verify patching within 7 days if possible; do not defer. Chrome's automatic update mechanism should deploy this quickly, but verify completion, especially on corporate-managed devices where auto-update may be controlled centrally. For offline or air-gapped environments, obtain the installer from Google's official distribution channels and deploy via configuration management. Test in a non-production environment first if feasible to confirm stability, though this patch addresses a memory safety bug and carries low regression risk.

Detection guidance

Monitor for Chrome process crashes or hangs that might indicate exploitation attempts. Correlate browser crash logs with visits to suspicious or attacker-controlled domains. Network detection is challenging because the exploit is delivered via HTML; focus instead on behavioral signals: unusual child processes spawned by Chrome, unexpected file or registry access, or credentials accessed immediately after a crash. Endpoint Detection & Response (EDR) tools should flag processes spawned with parent chrome.exe, particularly if they attempt to read sensitive files or contact external IPs. Check Chrome update status via hardware inventory or software asset management tools to identify endpoints still on older versions.

Why prioritize this

This is a critical remote code execution vulnerability in a ubiquitous browser with user-interaction-based exploitation. The CVSS 8.8 score reflects high severity across confidentiality, integrity, and availability. While the sandbox provides partial containment and KEV listing remains absent, the ease of delivery (malicious webpage) and broad platform coverage justify immediate patching. Delay increases the window of risk for both targeted attacks and potential mass exploitation if public exploits emerge.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), but user interaction needed (UI:R), with high impact to confidentiality (C:H), integrity (I:H), and availability (A:H). The score is tempered by the sandbox boundary—exploitation does not directly compromise the OS—but the high impact scores reflect the realistic risk of data theft and Chrome process disruption. The absence from KEV suggests either patching momentum is strong or active exploitation has not yet been detected; either way, proactive patching remains essential.

Frequently asked questions