CVE-2026-9886: Use after free in Base in Google Chrome on Mac prior to 148

Synopsis

A use-after-free vulnerability affects Google Chrome on macOS in versions prior to 148.0.7778.216. The flaw is reachable over the network without any prior authentication, though it requires a user to visit a crafted HTML page. Successful exploitation enables a remote attacker to escape the Chrome sandbox and gain capabilities beyond the browser process, with full confidentiality, integrity, and availability impact on the underlying system. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the affected Chrome instance must be reachable via normal browser traffic.

• AuthenticationNot required

  No account, session, or credential is needed; the attacker requires no prior access to the target system or application.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must socially engineer or redirect the user to attacker-controlled content.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race condition, specific memory layout, or other environmental precondition beyond victim interaction.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox, gaining code execution outside the browser process boundary on the victim's macOS host.
• With a sandbox escape achieved, the attacker reads files, credentials, and session tokens accessible to the user running Chrome.
• The attacker can write or modify files and data on the host, including persistent storage accessible to the compromised user account.
• The attacker can crash or disrupt Chrome and any dependent processes, denying service to the affected user session.