CVE-2026-9883: Use after free in Base in Google Chrome prior to 148

Synopsis

Use-after-free in the Base component of Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker to execute arbitrary code by luring a user to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to visit a malicious page. Successful exploitation gives the attacker full code execution inside the Chrome process. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable through normal internet or intranet browsing.

• AuthenticationNot required

  No account or credential of any kind is required; any unauthenticated remote party can serve the malicious page.

• Victim interactionRequired

  The victim must open or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by-navigation scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no special race conditions, memory-layout requirements, or other environmental preconditions on the attacker.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome renderer or browser process, enabling them to run any code the process is permitted to run.
• Confidential data accessible to the Chrome process, including stored credentials, session cookies, and page content, is exposed to the attacker.
• The attacker can write or modify files and browser state that the process has access to, including saved passwords, extensions, and cached data.
• The affected Chrome process can be crashed or held hostage, denying the user access to the browser and any web-based workflows depending on it.