CVE-2026-10003: Use after free in Views in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the Views component of Google Chrome allows a remote attacker to execute arbitrary code on the victim's machine. Exploitation requires the attacker to deliver a crafted HTML page and convince a user to perform specific UI gestures, making it a social-engineering-assisted attack reachable over the network; no authentication is needed, but the attack is not trivially reliable due to high complexity conditions. Successful exploitation gives the attacker full code execution inside the browser process, with access to sensitive data and the ability to modify or disrupt the user's session. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers a crafted HTML page over the network, so the victim's browser must be reachable through normal web browsing.

• AuthenticationNot required

  No account, credential, or prior authentication of any kind is required; the attacker only needs the victim to visit a malicious page.

• Victim interactionRequired

  Exploitation depends on convincing the victim to perform specific UI gestures on the crafted page, requiring a social-engineering step before the vulnerability fires.

• Attack complexityDetail

  The CVSS vector marks complexity as High, meaning the attacker must account for environmental factors such as memory layout or precise timing to reliably trigger the use-after-free condition.

Blast Radius

• Arbitrary code executes inside the Chrome browser process on the victim's machine, giving the attacker control over the browser's execution context.
• The attacker can read sensitive in-browser data including session tokens, saved credentials, and page contents from any open tab.
• The attacker can modify in-browser state, inject content into pages, and tamper with data the user submits through the browser.
• The browser process can be crashed or rendered unresponsive, disrupting the user's active session and any dependent workflows.