CVE-2026-9873: Use after free in Network in Google Chrome prior to 148

Synopsis

Use-after-free in the Network component of Google Chrome (versions before 148.0.7778.216) allows a remote attacker to execute arbitrary code inside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, only a single user interaction (opening the malicious page). Successful exploitation gives the attacker code execution within the Chrome sandbox, with full read, write, and availability impact on the affected process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential is needed; any anonymous remote attacker can attempt this exploit.

• Victim interactionRequired

  The victim must open or navigate to the attacker-controlled HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout prerequisites.

Blast Radius

• Reads confidential data accessible to the Chrome renderer process, including session tokens, page content, and credentials handled in-browser.
• Modifies in-process data and browser state, enabling tampering with rendered content or in-memory credentials.
• Crashes or disrupts the affected Chrome process, causing loss of availability for the browser session.
• Code execution within the Chrome sandbox positions an attacker to chain a sandbox-escape vulnerability for broader host access.