CVE-2026-9894: Use after free in GPU in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the GPU component of Google Chrome allows a remote attacker who has already compromised the renderer process to escape the browser sandbox. The attacker reaches the vulnerable code over the network but requires the victim to interact with a crafted HTML page, and no authentication is needed. Successful exploitation grants the attacker full read, write, and crash capabilities beyond the sandbox boundary, enabling code execution at the host process level. A patched-image rebuild at Chrome 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable and browsing remote content.

• AuthenticationNot required

  No account or credential of any kind is needed; the attack is launched from an unauthenticated remote position.

• Victim interactionRequired

  The victim must open or navigate to a crafted HTML page, making social engineering or malicious ad delivery the typical delivery mechanism.

• Attack complexityDetail

  Exploitation requires that the attacker has already compromised the renderer process, meaning this is a chained exploit with a high environmental prerequisite rather than a straightforward single-step attack.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code in the host browser process outside of renderer isolation.
• Attacker reads sensitive data accessible to the browser process, including stored credentials, session cookies, and local profile data.
• Attacker writes or modifies files and browser state accessible to the host process user account.
• Attacker can crash the browser process or destabilize the host application, causing denial of service.