CVE-2026-9897: Use after free in DOM in Google Chrome prior to 148

Synopsis

Use-after-free in the DOM component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the browser sandbox by convincing a user to visit a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to open a malicious page. Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remotely hosted crafted HTML page, so the Chrome instance must be reachable through normal web browsing.

• AuthenticationNot required

  No account or credentials are required on the targeted service; the attacker only needs to serve a malicious page.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, requiring a social-engineering step such as a phishing link or malicious ad.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout dependencies, or other environmental factors to succeed.

Blast Radius

• Attacker executes arbitrary code inside the Chrome renderer sandbox, gaining control of the sandboxed process.
• Confidential data processed or displayed in the affected tab, including session tokens, form inputs, and rendered page content, is exposed to the attacker.
• The attacker can tamper with page content, inject scripts, or use the sandboxed foothold as a stepping stone toward a sandbox-escape chain.
• The affected Chrome renderer process can be crashed or destabilized, disrupting the browsing session for the targeted user.