CVE-2026-9902: Use after free in Accessibility in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the Accessibility component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to escape the Chrome sandbox via a crafted HTML page. The attack requires network reachability, no authentication, but does require a victim to interact with a malicious page, and the attacker must already control the renderer process, making this a high-complexity chained exploit. Successful exploitation gives the attacker code execution outside the Chrome sandbox, effectively breaking the primary isolation boundary between browser content and the underlying host. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable and the attacker must be able to serve content to it.

• AuthenticationNot required

  No account or credential is needed; the attack is launched from an unauthenticated web page served to the victim.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled HTML page, making social engineering or a malicious ad/link a prerequisite.

• Attack complexityDetail

  Exploitation is high-complexity because it requires a prior renderer-process compromise as a stepping stone before the use-after-free sandbox escape can be triggered.

Blast Radius

• Attacker breaks out of the Chrome sandbox, gaining code execution in the context of the browser process on the victim host.
• With sandbox escape achieved, the attacker reads files, credentials, and session data accessible to the user running Chrome.
• The attacker can write to or modify files and persistent storage on the host, including browser profile data and OS-level user directories.
• The attacker can terminate or disrupt the Chrome process and any dependent browser-hosted services, causing a denial of service to the victim.