CVE-2026-9879: Critical Out-of-Bounds Write in Chrome ANGLE Graphics Engine

Technical summary

CVE-2026-9879 is an out-of-bounds write vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Chromium-based browsers. The flaw resides in memory management during graphics operations, allowing an attacker to write beyond the boundaries of an allocated buffer. This memory corruption can be leveraged to achieve remote code execution when a user visits a crafted HTML page. The vulnerability affects Chrome versions prior to 148.0.7778.216 and is classified as Critical by the Chromium security team, with a CVSS 3.1 score of 8.8 (High severity) due to its network-based attack vector, low complexity, lack of required privileges, and ability to compromise confidentiality, integrity, and availability.

Business impact

Exploitation of this vulnerability poses a direct risk to any organization where users browse the web with vulnerable Chrome versions. Successful attacks could lead to unauthorized code execution on employee workstations, enabling theft of sensitive data, installation of malware, lateral network movement, or system compromise. The barrier to exploitation is low—users need only visit a malicious site, making watering-hole attacks and targeted phishing campaigns viable delivery mechanisms. For organizations managing large Chrome deployments, delayed patching creates a window of exposure during which targeted or mass exploitation is feasible.

Affected systems

The vulnerability affects Google Chrome on Windows, macOS, and Linux systems running versions prior to 148.0.7778.216. While the underlying ANGLE library is cross-platform, the practical exposure depends on Chrome deployment scope within your environment. Secondary operating systems (Windows, macOS, Linux kernel) are listed as affected because they host the vulnerable browser, not because the flaw is in the OS itself.

Exploitability

Exploitability is high. The attack requires only network access and user interaction—the victim must visit a malicious webpage. No authentication, elevated privileges, or local access is necessary. The straightforward attack surface (arbitrary HTML) and the critical nature of the underlying flaw make this a likely target for active exploitation. Exploit toolkits and proof-of-concept code typically emerge quickly for graphics engine vulnerabilities, as they are well-studied by security researchers.

Remediation

Organizations should prioritize patching Chrome to version 148.0.7778.216 or later across all user systems. For managed environments, enforce automatic updates or use group policies to enforce minimum Chrome versions. Users should manually update Chrome immediately via Settings > About Google Chrome if automatic updates are not configured. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the last data update, but that does not indicate low risk—it reflects the recency of disclosure and the time lag in KEV reporting.

Patch guidance

Chrome 148.0.7778.216 and all subsequent versions contain the fix. Verify the exact patch version against Google's official Chrome release notes to confirm the fix applies to your deployment model (Stable, Extended Stable, or channel-specific builds). In managed environments, test the patch in a staging environment before rolling out to production users. For organizations using legacy or extended-support Chrome versions, consult Google's update timeline; some users may be on Extended Stable Channel, which has different release cadences.

Detection guidance

Monitor browser version strings in logs and endpoint telemetry to identify systems still running Chrome versions prior to 148.0.7778.216. Implement alerts on User-Agent headers in web proxies or network logs to flag outdated Chrome instances attempting connections. Endpoint Detection and Response (EDR) tools should monitor for suspicious process execution or memory corruption patterns following Chrome renderer process activity, though such signals are often subtle in memory-safety exploits. Network-based indicators are limited; prioritize version inventory and patching velocity tracking as primary detection mechanisms.

Why prioritize this

This vulnerability merits immediate remediation despite not yet appearing in the KEV catalog. The combination of network-based attack vector, low user interaction friction, remote code execution impact, and high CVSS score (8.8) makes it an attractive target for both targeted and opportunistic campaigns. The graphics engine is a high-value target due to its complexity and historical prevalence of memory-safety flaws. Delayed patching should be treated as elevated risk, especially in environments exposed to untrusted web content or where users frequently visit external websites.

Risk score, explained

The CVSS 3.1 score of 8.8 (High) reflects: network-based attack vector (AV:N) eliminating the need for local access; low attack complexity (AC:L) requiring no special conditions or user sophistication; no privilege requirements (PR:N); and user interaction necessary only to visit a page (UI:R), a low bar in real-world web browsing. The score captures three full impact categories—confidentiality, integrity, and availability (C:H/I:H/A:H)—because successful exploitation enables arbitrary code execution with no sandboxing bypasses required beyond the initial memory corruption. The score appropriately reflects the severity of remote code execution via a common attack surface.

Frequently asked questions