CVE-2026-10016: Use after free in DOM in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the DOM engine of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The flaw is reachable over the network and requires no authentication, only a single user interaction (visiting a malicious page). Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, enabling data theft, further exploitation, and potential sandbox escapes. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target must be able to reach an attacker-controlled HTML page from their browser.

• AuthenticationNot required

  No account, session token, or credential of any kind is needed; the exploit works against any unauthenticated visitor.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector (phishing link, malicious ad, or compromised site).

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental preconditions to trigger.

Blast Radius

• Arbitrary code executes inside the Chrome renderer sandbox, giving the attacker full control of the sandboxed process.
• The attacker reads any data accessible to the renderer, including session tokens, form contents, and page DOM state for the active origin.
• The attacker can write or tamper with page content and in-memory state within the sandboxed context.
• A successful sandbox escape (chained with a secondary bug) would extend execution to the host user account and its files.