CVE-2026-9896: Out of bounds write in V8 in Google Chrome prior to 148

Synopsis

An out-of-bounds write vulnerability exists in V8, the JavaScript engine embedded in Google Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page. Successful exploitation allows a remote attacker to execute arbitrary code inside the Chrome sandbox. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable or browsing-capable from an internet-connected or network-adjacent host.

• AuthenticationNot required

  No account, session token, or credential of any kind is required before the exploit is triggered.

• Victim interactionRequired

  The victim must open a crafted HTML page in Chrome, meaning the attacker depends on a social-engineering step such as a phishing link or malicious advertisement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• Executes attacker-controlled code inside the Chrome renderer sandbox, giving the attacker a foothold within the browser process.
• Reads sensitive in-browser data such as stored credentials, session cookies, and page content at high confidentiality impact.
• Modifies browser state and in-memory data, enabling tampering with page content or injecting further payloads at high integrity impact.
• Crashes or destabilizes the renderer process, causing denial of service for the affected browser session at high availability impact.