CVE-2026-9887: Use after free in Proxy in Google Chrome prior to 148

Synopsis

Use-after-free vulnerability in the Proxy component of Google Chrome prior to version 148.0.7778.216. The flaw is triggered locally by a crafted PAC (proxy auto-configuration) script and requires the user to interact with malicious content, though no authentication is needed. Successful exploitation gives an attacker full code execution on the host, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker does not need direct network access to the target service; they need an existing process or shell context on the host, or to deliver a malicious PAC script to a local user.

• AuthenticationNot required

  No account credentials or prior authentication are required to deliver the malicious PAC script that triggers the vulnerability.

• Victim interactionRequired

  The victim must interact with attacker-controlled content (for example, loading a crafted PAC script) for the exploit to execute.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Executes arbitrary code in the context of the Chrome process on the victim's machine.
• Reads sensitive data accessible to that process, including stored credentials, session tokens, and browser profile data.
• Modifies or deletes files and data reachable by the compromised process.
• Crashes or disrupts the Chrome process, denying service to the affected user.