CVE-2026-10001: Use after free in PerformanceManager in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the PerformanceManager component of Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The flaw is reachable over the network but requires the victim to interact with attacker-controlled content, and successful exploitation gives the attacker full read, write, and availability impact on the host beyond the sandbox boundary. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to load attacker-controlled content.

• Victim interactionRequired

  The victim must visit or otherwise interact with a crafted HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploitation is rated High complexity because the attacker must have already compromised the renderer process before the use-after-free can be used for a sandbox escape, introducing a significant precondition.

Blast Radius

• A successful attacker escapes the Chrome sandbox and gains code execution in the context of the browser process on the host.
• With sandbox containment removed, the attacker reads files, credentials, and session tokens accessible to the browser process.
• The attacker can write or modify files and data accessible to the browser process on the underlying host.
• The attacker can crash or disrupt browser and host-level services that the browser process has access to.