CVE-2026-9891: Use after free in Extensions in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the Extensions subsystem of Google Chrome prior to version 148.0.7778.216 allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox via a crafted Chrome Extension. The flaw is reachable over the network and requires no authentication or user interaction, though the attacker must first have achieved renderer compromise before triggering the escape. Successful exploitation grants full code execution outside the sandbox, enabling complete confidentiality, integrity, and availability impact on the host. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network to deliver a crafted Chrome Extension payload to the compromised renderer process.

• AuthenticationNot required

  No authentication is needed; the attacker requires no account or credential on the target system.

• Victim interactionNot required

  No victim interaction is required once the renderer process has been compromised.

• Attack complexityDetail

  Attack complexity is high because the attacker must first independently compromise the Chrome renderer process before this use-after-free can be leveraged for sandbox escape.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code in the context of the host process, breaking the primary isolation boundary.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and local files, becomes readable.
• The attacker can modify files and system state on the host with the permissions of the Chrome process user.
• The host process can be crashed or forced into an unrecoverable state, disrupting service for the affected user session.