CVE-2026-9884: Use after free in Browser in Google Chrome on Mac prior to 148

Synopsis

A use-after-free vulnerability affects Google Chrome on macOS in versions prior to 148.0.7778.216. The flaw is reachable over the network without any authentication, though it requires a user to visit a crafted HTML page. Successful exploitation gives a remote attacker arbitrary code execution in the context of the browser process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to an attacker-controlled HTML page, requiring the target Chrome instance to be reachable through normal browser web traffic.

• AuthenticationNot required

  No account credentials or prior authentication are needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker depends on a social-engineering step such as a phishing link or malicious ad to trigger the bug.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• Attacker executes arbitrary code inside the Chrome browser process on the victim's Mac.
• Code execution runs under the browser process's privileges, giving access to cookies, saved passwords, and session tokens stored by the browser.
• Attacker can read and exfiltrate files accessible to the browser process account on the local filesystem.
• Attacker can disrupt or crash the browser process, terminating all active sessions and tabs.