CVE-2026-9969: Chrome ANGLE Remote Code Execution – Patch Now

Technical summary

CVE-2026-9969 addresses an input validation flaw (CWE-20) in ANGLE, Google's graphics library abstraction layer integrated into Chromium-based browsers. The insufficient validation of untrusted input permits remote code execution when processing crafted HTML and graphics content. The vulnerability affects Chrome versions prior to 148.0.7778.216. The attack vector is network-based, requires minimal complexity, no privileges, and user interaction in the form of visiting a malicious webpage. The vulnerability impacts confidentiality, integrity, and availability—an attacker can read sensitive data, modify system state, or crash the browser.

Business impact

Remote code execution vulnerabilities in widely-deployed browsers like Chrome pose significant organizational risk. An attacker can compromise employee workstations through drive-by attacks—no social engineering or malware distribution infrastructure required. Once code executes in the browser's process context, attackers can steal credentials, exfiltrate data, establish persistent footholds, or pivot to network resources. Organizations with high user populations on Chrome face broad exposure. The CVSS 8.8 (High) score reflects the ease of exploitation combined with severe impact. Time-to-exploitation is typically measured in days post-disclosure, making rapid patching critical.

Affected systems

Google Chrome prior to version 148.0.7778.216 is directly affected. Because ANGLE is fundamental to Chromium's graphics pipeline, this affects all Chromium-based browsers (Edge, Brave, Opera, etc.) running comparable versions. The vulnerability is platform-agnostic—it affects users on Windows, macOS, and Linux. Users who have not updated Chrome to 148.0.7778.216 or later remain vulnerable. Notably, this is not a kernel or operating system vulnerability; the OS listed in the vendor products field reflects downstream exposure through the browser's integration with graphics subsystems.

Exploitability

Exploitation is relatively straightforward: an attacker crafts malicious HTML and hosts it on a server or injects it into a legitimate site. When a user with a vulnerable Chrome version visits the page, ANGLE processes the graphics instructions without proper validation, triggering code execution. No exploit kit, zero-day capability, or advanced techniques are required—the flaw can be triggered through standard web delivery. The barrier to weaponization is low. The requirement for user interaction (visiting the webpage) is the primary friction point, though phishing, ad networks, or compromised legitimate sites can reliably drive traffic. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but given its severity and ease of exploitation, weaponized POC development and real-world attacks are highly probable.

Remediation

Update Google Chrome to version 148.0.7778.216 or later. Chrome's auto-update mechanism will typically deploy this update within 24–48 hours of release; however, organizations should verify completion across endpoints. Users on macOS and Linux should similarly update to the patched version. For Chromium-based alternatives (Edge, Brave, etc.), check vendor advisories for corresponding patch versions and timelines. Organizations cannot reliably block this vulnerability at the network level because malicious content can reside on legitimate domains. The most effective mitigations are prompt patching and user awareness training to reduce visits to untrusted sites.

Patch guidance

Verify that Google Chrome on all organizational devices has been updated to version 148.0.7778.216 or later. Use your mobile device management (MDM), endpoint detection and response (EDR), or patch management tools to enumerate Chrome versions across Windows, macOS, and Linux endpoints. Most modern enterprise deployments auto-update Chrome, but confirm settings are enforced: On Windows, verify that the Google Update service is running and not blocked by policy. On macOS, verify that the Chrome auto-update daemon is enabled. On Linux, ensure package managers or snap updates are current. For users with Chrome extended support versions, cross-reference patch availability with Google's release notes. After patching, restart browsers to activate the update; some users may need to close and reopen Chrome or reboot if the browser is pinned in memory.

Detection guidance

Monitor for Chrome version compliance—flag any devices reporting versions below 148.0.7778.216. Web proxies and DNS security tools can surface attempts to visit known malicious sites hosting the exploit, though the payload may be delivered via legitimate ad networks or compromised legitimate domains. EDR solutions should monitor for suspicious child processes spawned by the Chrome process (chrome.exe, Google Chrome, etc.), unusual file writes, or memory corruption artifacts. Because the flaw is in graphics handling, look for anomalous calls to graphics drivers (d3d12.dll, libGLX, etc.) or ANGLE-related modules (libEGL, libGLESv2). Detect policy violations where users disable auto-updates or downgrade Chrome versions. Network detection is limited because traffic is HTTPS-encrypted; focus on behavioral signals post-exploitation (lateral movement, credential use, data exfiltration).

Why prioritize this

This vulnerability merits immediate attention due to its combination of high severity (CVSS 8.8), ubiquity of affected software (Chrome is the dominant browser), ease of exploitation (web-based, no privilege escalation required), and low user friction (browsing is normal behavior). The attack surface includes any user on any network visiting compromised or attacker-controlled websites. Organizations should treat this with the same urgency as a critical OS vulnerability. Rapid patching prevents commodity malware and targeted campaigns from compromising workstations at scale. The lack of KEV listing does not diminish risk; it typically reflects recency rather than low real-world exploitation.

Risk score, explained

The CVSS 3.1 score of 8.8 (High) reflects: (1) Network attack vector (AV:N)—no local access required; (2) Low attack complexity (AC:L)—no special conditions or techniques; (3) No privileges required (PR:N); (4) User interaction required (UI:R)—user must visit the webpage; (5) Unchanged scope (S:U)—impact is limited to the browser process, not the wider system; (6) High impact on confidentiality, integrity, and availability (C:H/I:H/A:H)—code execution permits complete compromise of browser data and functionality. The score does not reach Critical (9.0+) because user interaction is required, but the ease and speed of exploitation and the attractiveness of browser compromise as an attack entry point justify aggressive prioritization.

Frequently asked questions