CVE-2026-9944: Chrome ANGLE Memory Leak Cross-Origin Data Disclosure

Technical summary

This vulnerability stems from uninitialized memory use (CWE-457) in ANGLE, Chrome's abstraction layer for graphics APIs. When the renderer process has been compromised by an attacker, they can supply a crafted HTML page that reads uninitialized memory regions containing cross-origin data. The Chromium security team classified this as High severity at the graphics layer level, though the CVSS score of 3.1 reflects the prerequisite that renderer compromise must already exist. The flaw allows information disclosure without code execution or data modification.

Business impact

For enterprise environments, this vulnerability poses a moderate but real information security risk. While it requires an existing renderer compromise, successful exploitation could expose sensitive user data from other websites—authentication tokens, personal information, or business data. Organizations relying on Chrome for business applications should prioritize patching, especially those handling sensitive data or operating in threat environments where renderer exploits are already circulating. The impact is confined to confidentiality; integrity and availability are not affected.

Affected systems

Google Chrome versions prior to 148.0.7778.216 are affected across all major operating systems: Windows, macOS, and Linux. The vulnerability exists in ANGLE, which is integrated into Chrome's rendering engine, so any deployment of unpatched Chrome on these platforms is at risk. Other Chromium-based browsers may inherit similar exposure depending on their version and ANGLE integration; verify with your specific browser vendor.

Exploitability

Exploitation requires a two-stage attack: first, the attacker must compromise the Chrome renderer process through another vulnerability or attack vector (such as a site isolation bypass or prior renderer exploit). Second, they deliver a crafted HTML page to leak cross-origin data. The CVSS score of 3.1 reflects this high barrier to initial renderer compromise. Once renderer control is gained, however, exploitation of this flaw is straightforward. No active exploitation in the wild has been publicly disclosed, and the vulnerability is not tracked on the CISA KEV list.

Remediation

Update Google Chrome to version 148.0.7778.216 or later. Automatic updates are enabled by default in Chrome; verify successful deployment via the browser's About page (chrome://about). On managed deployments, push the update through your endpoint management system. No workarounds exist for unpatched versions, so timely patching is essential. Confirm the new version is running before resuming sensitive web-based activities.

Patch guidance

Chrome 148.0.7778.216 and later versions contain the fix. Deploy updates through Chrome's built-in update mechanism or via enterprise deployment tools (Google Admin Console, WSUS, etc.). Test the patch in a non-production environment first if your organization has strict change control policies. After deployment, audit endpoint telemetry to confirm version compliance. No rollback is necessary unless the patch introduces a regression; Chromium's rapid release cycle typically resolves any such issues within days.

Detection guidance

Monitor Chrome version numbers across your environment using endpoint detection and response (EDR) tools or mobile device management (MDM) platforms. Check running process versions via System Information or command-line tools (e.g., 'chrome.exe --version' on Windows). Log and alert on any instances of Chrome version < 148.0.7778.216. Additionally, monitor for unusual cross-origin data access patterns in application logs if you operate custom web applications; however, this is difficult without renderer-level instrumentation. Focus on ensuring version compliance as the primary control.

Why prioritize this

Despite the low CVSS score, prioritize this patch because it addresses a real information disclosure path in a widely deployed browser used for business applications. The prerequisite of renderer compromise prevents immediate risk, but the presence of actively exploited renderer vulnerabilities in the wild means this secondary vulnerability could rapidly become dangerous. Organizations with high data sensitivity or in mature threat environments should patch within 1–2 weeks; others within 30 days.

Risk score, explained

The CVSS 3.1 score of 3.1 (Low severity) reflects the requirement for pre-existing renderer compromise (Attack Vector: Network, Attack Complexity: High, Privileges: None, User Interaction: Required) and the information disclosure impact only (Confidentiality: Low, Integrity: None, Availability: None). However, this numeric score underrepresents business risk in sensitive environments where renderer exploits are known and actively exploited. Security teams should apply organizational context: data sensitivity, browser usage patterns, and threat modeling outcomes should drive priority higher than the base CVSS alone suggests.

Frequently asked questions