CVE-2026-9928: Critical Chrome ANGLE Out-of-Bounds Read Vulnerability on Windows

Technical summary

CVE-2026-9928 is an out-of-bounds read vulnerability (CWE-125) in ANGLE, Chrome's abstraction layer for graphics APIs. The flaw exists in how ANGLE processes certain graphics rendering operations on Windows. By carefully constructing HTML content that triggers specific rendering paths, a remote attacker can read memory beyond allocated buffer boundaries. This information disclosure can leak values that bypass security mitigations, enabling subsequent arbitrary code execution within the Chrome process. The vulnerability requires user interaction (visiting a malicious page) but no additional privileges or special conditions.

Business impact

This vulnerability poses a significant risk to any organization where employees use Chrome on Windows. Successful exploitation leads to arbitrary code execution in the browser context, potentially allowing attackers to steal credentials, sensitive data, or establish persistence. Targeted campaigns could use this to compromise specific users in your organization. The relatively low complexity (standard HTML page) and minimal user interaction required make this a practical attack vector for both mass campaigns and targeted intrusions.

Affected systems

Google Chrome on Microsoft Windows systems running versions prior to 148.0.7778.216 are affected. Users on other operating systems (macOS, Linux, Android, iOS) are not vulnerable to this specific flaw. The vulnerability affects all Chrome installations on vulnerable Windows versions; auto-update may have already remediated this for many users, but manual verification is recommended.

Exploitability

The exploitability is moderate-to-high. While the vulnerability requires a user to visit a malicious website or open a weaponized HTML document, no elevated privileges or special system configuration is needed. ANGLE's role in routine graphics rendering means the vulnerable code path can be triggered reliably. However, successful code execution exploitation requires chaining the information disclosure with additional techniques, making truly reliable weaponization non-trivial but feasible for skilled attackers. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome to version 148.0.7778.216 or later. Users with auto-update enabled may already be protected; verify your version via Chrome's About menu (chrome://about). For organizations managing Chrome deployments, push version 148.0.7778.216 or newer through your deployment mechanisms. No workarounds exist for unpatched systems, so prompt patching is critical.

Patch guidance

Verify you are running Chrome version 148.0.7778.216 or later by navigating to chrome://about, which also shows auto-update status. If auto-update is enabled and your version is older than 148.0.7778.216, manually trigger an update restart. For managed deployments, use your organization's Chrome policy infrastructure to enforce minimum version requirements and verify compliance. Test patches in a non-production environment first to ensure compatibility with internal web applications or extensions.

Detection guidance

Network-level detection is challenging due to the rendering-based nature of the exploit. Endpoint detection should focus on Chrome process anomalies: monitor for unexpected child processes spawned by Chrome, abnormal file access patterns, or network connections initiated by the browser. Browser crash reports and renderer process exits may indicate exploitation attempts. Web proxy logs showing access to suspicious or newly registered domains visited just before Chrome crashes warrant investigation. Consider enabling Chrome's Enhanced Safe Browsing for additional protection against malicious pages.

Why prioritize this

This vulnerability merits immediate attention due to its High CVSS score (8.8), remote network exploitability, minimal user friction, and the ubiquity of Chrome in enterprise environments. The combination of information disclosure and arbitrary code execution in a widely-used application creates significant organizational risk. Although not yet on CISA's KEV list, the straightforward attack surface makes it a likely target for adversary development.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: remote network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R). The impact is severe—confidentiality, integrity, and availability are all compromised (C:H/I:H/A:H). The score appropriately captures the threat: easy-to-exploit for attackers yet requiring victims to click or visit a malicious page. The High severity aligns with Chromium's assessment and the real-world threat landscape.

Frequently asked questions