CVE-2026-10005: Use after free in WebAppInstalls in Google Chrome on Mac prior to 148

Synopsis

A use-after-free vulnerability affects the WebAppInstalls component of Google Chrome on macOS in versions prior to 148.0.7778.216. The flaw is reachable over the network but requires an attacker to convince a user to perform specific UI gestures on a crafted HTML page; no prior authentication to Chrome or the system is needed. Successful exploitation gives the attacker arbitrary code execution in the context of the browser process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the target to a crafted HTML page, so the Chrome instance must be reachable in the sense that the user must be able to browse to attacker-controlled content.

• AuthenticationNot required

  No account, session token, or prior credential is needed; the attack originates from an unauthenticated remote position via a web page.

• Victim interactionRequired

  The attacker must convince the user to perform specific UI gestures inside Chrome, making this a social-engineering-dependent exploit.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit depends on precise timing, memory layout, or other environmental conditions that the attacker cannot fully control, reducing reliability.

Blast Radius

• A successful attacker achieves arbitrary code execution inside the Chrome browser process on the affected Mac host.
• With code execution in the browser context, the attacker can read sensitive data accessible to Chrome, including saved passwords, cookies, and session tokens stored in the browser profile.
• The attacker can modify browser state, inject content into open tabs, or write files to locations the browser process has access to.
• The browser process crash or takeover can deny service to the user and any web applications running in that Chrome session.