PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9946 Google CVE debrief

Use-after-free vulnerability in ANGLE, the graphics rendering layer used by Google Chrome. A remote attacker who has already compromised the renderer process can exploit this flaw to potentially escape the Chrome sandbox via a crafted HTML page. The vulnerability affects Chrome versions prior to 148.0.7778.216 on Windows, macOS, and Linux. Google has assigned a High severity rating to this issue.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with Chrome deployments on Windows, macOS, or Linux; security teams defending against advanced persistent threats that employ browser-based attack chains; and administrators managing endpoints where users access untrusted web content.

Technical summary

This vulnerability exists in ANGLE (Almost Native Graphics Layer Engine), which translates OpenGL ES API calls to platform-specific graphics APIs. A use-after-free condition can be triggered when a crafted HTML page manipulates graphics resources in a way that causes memory to be freed and subsequently accessed. Successful exploitation requires prior compromise of the Chrome renderer process, which runs in a restricted sandbox. The attacker can then leverage this vulnerability to escape that sandbox and execute code with elevated privileges. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H reflects network attack vector, high attack complexity, no privileges required, user interaction required, changed scope, and high impacts to confidentiality, integrity, and availability.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.216 or later on all affected platforms (Windows, macOS, Linux).
  • Verify automatic update mechanisms are enabled and functioning for Chrome deployments.
  • Prioritize patching for systems where users browse untrusted or attacker-controlled web content, as this vulnerability requires renderer process compromise as a prerequisite.
  • Monitor for indicators of renderer process compromise as an early warning signal for potential sandbox escape attempts.
  • Restrict access to the Chromium issue tracker reference (ref-5) to security personnel with appropriate permissions if seeking additional technical details.

Evidence notes

The NVD entry lists this vulnerability as 'Analyzed' with a CVSS 3.1 score of 8.3 (HIGH). The CPE criteria indicate affected versions are Chrome prior to 148.0.7778.216 on Windows, macOS, and Linux platforms. The Chromium issue tracker reference (ref-5) is marked 'Permissions Required,' indicating restricted access to technical details. The vendor advisory (ref-4) provides the stable channel update notification. CWE-416 (Use After Free) is identified as the weakness type.

Official resources

2026-05-28T23:16:52.740Z