CVE-2026-9901: Use-After-Free in Chrome ANGLE Graphics Library (CVSS 7.5)

Technical summary

CVE-2026-9901 is a use-after-free vulnerability (CWE-416) in the ANGLE graphics library within Google Chrome. The flaw exists in memory management within ANGLE's rendering pipeline, allowing an attacker who has already gained control of the renderer process to trigger a memory access after the object has been freed. By crafting a malicious HTML page with specific WebGL or graphics API calls, an attacker can cause the freed memory to be used in an unsafe manner, leading to arbitrary code execution. The CVSS 3.1 score of 7.5 (High) reflects the requirement for initial renderer compromise and user interaction, but acknowledges the high-impact consequences if exploited.

Business impact

The primary business risk is multi-stage compromise. While a use-after-free in isolation requires the renderer to already be compromised, it significantly elevates the damage from any prior renderer exploit. An attacker with renderer-level access gains a reliable path to system-level code execution, potentially enabling lateral movement, data exfiltration, malware installation, or denial of service. For organizations where Chrome is a primary browsing platform, this increases the cost of a breach because it removes a containment boundary. Users of Chrome on Windows, macOS, and Linux systems running versions prior to 148.0.7778.216 are at risk.

Affected systems

Google Chrome prior to version 148.0.7778.216 is vulnerable. The vulnerability affects Chrome running on Windows, macOS, and Linux environments. No other products are inherently vulnerable, though the underlying graphics abstraction principles may be relevant to other Chromium-based browsers that bundle ANGLE. Users should verify their Chrome version by navigating to chrome://help, which will auto-update the browser and display the current version.

Exploitability

Exploitability is currently low in the wild because the attack chain is complex: an attacker must first compromise the renderer process through a separate vulnerability or social engineering, and then must craft a malicious webpage that the victim visits. The vulnerability itself (use-after-free) is a common memory safety bug, and ANGLE's graphics API is well-known, making weaponization technically feasible for skilled attackers. However, the requirement for initial renderer compromise and user interaction substantially raises the barrier to entry. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread exploitation has been documented to date.

Remediation

The definitive fix is to update Google Chrome to version 148.0.7778.216 or later. Chrome's auto-update mechanism typically deploys patches automatically within hours of release, though enterprise deployments may have update policies that delay installation. Verify your current version at chrome://help. For organizations with managed Chrome deployments, confirm that update policies are set to install this patch promptly. As a supplementary control, restrict user ability to navigate to untrusted websites and reinforce security awareness training about phishing and social engineering, since initial renderer compromise is a prerequisite for this exploit.

Patch guidance

Update Chrome to version 148.0.7778.216 or newer. On Windows and macOS, Chrome will typically auto-update; check chrome://help to force an update check and confirm the new version is installed. On Linux, use your distribution's package manager or rebuild Chrome from source if you maintain a custom build. Enterprise administrators should verify that security update policies are applied and validate that systems are actually running the patched version within 48 hours of availability. Test critical web applications in the updated environment before rolling out broadly, particularly those with dependencies on WebGL or GPU acceleration, to rule out compatibility issues.

Detection guidance

Detection is challenging because the vulnerability resides deep in graphics memory management and requires monitoring browser process behavior. Organizations with endpoint detection and response (EDR) tools should enable memory-protection monitoring on Chrome processes and watch for anomalous memory access patterns or privilege escalation attempts following Chrome renderer process activity. Log Chrome version and update timestamps from asset management systems to confirm patched versions are deployed. Review browser security logs for signs of prior renderer compromise (crashes, unusual plugin loading, suspicious network activity from the browser). Web application firewalls can be configured to block requests known to trigger similar use-after-free patterns in ANGLE, though signatures must be carefully tuned to avoid false positives.

Why prioritize this

This vulnerability merits prompt patching because it is a high-severity flaw in a ubiquitous application (Chrome), affects all major operating systems, and provides a reliable mechanism for privilege escalation once the renderer is compromised. Although it is not currently exploited in the wild (KEV=false), the combination of memory safety bugs in graphics libraries and the widespread presence of Chrome in enterprise and consumer environments creates significant long-term risk. Patch within 2 weeks for most organizations; 48 hours for environments where Chrome is used to access highly sensitive data or where prior renderer vulnerabilities are a known concern.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network vector (AV:N) because the attacker delivers the malicious page over HTTP/HTTPS; (2) High complexity (AC:H) because initial renderer compromise is required; (3) No privileges required (PR:N) for the use-after-free itself, though compromised renderer context is assumed; (4) User interaction required (UI:R) because the victim must navigate to the malicious page; (5) Unchanged scope (S:U) within the browser process; (6) High impact on confidentiality, integrity, and availability (C:H/I:H/A:H) because arbitrary code execution in renderer context can read memory, modify content, and crash the browser. The score appropriately penalizes the multi-stage requirement while recognizing the severe consequences if both stages succeed.

Frequently asked questions