CVE-2026-9965: Critical Out-of-Bounds Write in Chrome ANGLE Graphics Library

Technical summary

CVE-2026-9965 is an out-of-bounds write vulnerability (CWE-787) in the ANGLE graphics translation layer used by Chrome. ANGLE abstracts DirectX, Metal, and OpenGL APIs to improve cross-platform graphics performance. The flaw allows a remote attacker to write data outside allocated heap buffers via crafted HTML and WebGL content. Successful exploitation results in heap corruption, potentially enabling arbitrary code execution. The vulnerability affects Chrome versions prior to 148.0.7778.216. The CVSS 3.1 score of 8.8 (High) reflects the network attack vector, low attack complexity, and high impact across confidentiality, integrity, and availability.

Business impact

This vulnerability poses a significant risk to organizations where employees use Chrome for work activities. An attacker can compromise user workstations by hosting malicious content on websites or injecting payloads into legitimate sites. Potential impacts include theft of credentials, session tokens, and sensitive data accessible to the user; installation of malware or remote access trojans; and lateral movement into corporate networks. Organizations relying on Chrome in security-sensitive roles (developers, DevOps, cloud administrators) face elevated risk due to the privileges available to compromised browser processes.

Affected systems

Google Chrome on Windows, macOS, and Linux is directly affected. All versions prior to 148.0.7778.216 contain this vulnerability. While the CVE references Apple macOS and Microsoft Windows as vendor-product combinations, the root issue is Chrome itself; affected systems are those running vulnerable Chrome installations on any supported OS. Linux systems using Chrome (including Chromium-based derivatives) are also in scope if running unpatched versions.

Exploitability

Exploitability is high from a practical standpoint. The attack requires only that a user visit a malicious or compromised webpage—no special configuration, authentication, or user action beyond normal browsing is needed. An attacker can host a weaponized site or compromise legitimate high-traffic pages to maximize reach. The Chromium security team classified this as High severity, and the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms remote, unauthenticated exploitation with minimal complexity. However, the vulnerability is not currently listed on CISA's KEV catalog, suggesting limited evidence of active exploitation at the time of advisory publication.

Remediation

Update Google Chrome to version 148.0.7778.216 or later immediately. Chrome's auto-update mechanism will typically deploy the patch within hours of release, but verify that auto-update is enabled in your environment. Users can manually check for updates via Chrome menu > Help > About Google Chrome. Organizations should confirm patch deployment across all endpoints and verify that no vulnerable versions remain accessible through legacy configurations or managed deployments.

Patch guidance

Prioritize Chrome patching as an urgent security task. Configure Chrome to auto-update if not already enabled. For managed enterprise deployments, verify that update policies are set to the latest stable channel. Test the patch in a non-production environment to rule out any compatibility issues with critical web-based applications before rolling out organization-wide. After patching, spot-check a sample of user devices to confirm version 148.0.7778.216 or later is running. Consider temporarily restricting access to untrusted websites during any delay in patch deployment.

Detection guidance

Monitor Chrome version inventory using your endpoint management or mobile device management tools to identify unpatched installations. Set alerts for systems reporting Chrome versions earlier than 148.0.7778.216. Web proxies and firewalls can log suspicious WebGL-based content delivery or pages with encoded exploit payloads, though detection is challenging without behavioral analysis. Monitor for unexpected child processes spawned from Chrome or abnormal network activity from Chrome processes post-compromise. Incident response teams should prioritize investigating any reports of unusual browser behavior, unexpected crashes, or unexplained system activity on machines where vulnerable Chrome versions were confirmed.

Why prioritize this

This vulnerability merits immediate patching. The combination of high CVSS score (8.8), trivial attack surface (any visited webpage), and high impact (remote code execution) makes it attractive to attackers. Although not yet listed on CISA's KEV, the technical characteristics suggest active exploitation is likely as researchers reverse-engineer the fix. Heap corruption vulnerabilities in browser engines have historically been weaponized quickly. Delaying patching significantly increases breach risk across your user base.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Network-accessible attack vector (AV:N) requiring no special network positioning; low attack complexity (AC:L) with no need for authentication or special conditions; minimal user interaction limited to visiting a webpage (UI:R); and high impact across all three security dimensions—confidentiality (user data and credentials exposed), integrity (code execution enables malware installation), and availability (process crash or system compromise). The score appropriately represents a critical remote code execution vulnerability in widely-used software.

Frequently asked questions