CVE-2026-10006: Race in WebAudio in Google Chrome prior to 148

Synopsis

A race condition in the WebAudio component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires the attacker to serve a crafted HTML page that the victim must visit, and the attack must win a timing race within the browser process. Successful exploitation gives the attacker code execution within the Chrome sandbox, and a patched-image rebuild at 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by hosting a crafted HTML page the victim's browser fetches remotely.

• AuthenticationNot required

  No authentication or account credentials are needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must actively visit the attacker-controlled HTML page, making this dependent on a social-engineering or malicious-redirect step.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must win a timing race inside the browser process, which is sensitive to scheduling conditions and may require repeated attempts.

Blast Radius

• Within the Chrome sandbox, the attacker gains the ability to execute arbitrary code, enabling full control over the sandboxed renderer process.
• Confidential data accessible to the renderer, such as page content, session state, and credentials entered in the browser, can be read by the attacker.
• The attacker can modify in-memory browser state and page content visible to the user, enabling tampering with rendered output.
• All three impact dimensions (confidentiality, integrity, availability) are rated HIGH, meaning the attacker can also crash or destabilize the affected renderer process.