CVE-2026-9905: Use after free in Accessibility in Google Chrome on Windows prior to 148

Synopsis

A use-after-free vulnerability exists in the Accessibility component of Google Chrome on Windows in versions prior to 148.0.7778.216. The flaw is reachable over the network but requires the attacker to have already compromised the renderer process and requires the victim to interact with a crafted HTML page; successful exploitation enables a sandbox escape, granting the attacker capabilities outside the browser sandbox with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted Chrome instance must be reachable and browsing attacker-controlled or attacker-influenced content.

• AuthenticationNot required

  No account or credentials are required; the attack is initiated by luring a user to a crafted page without any prior authentication to the target system.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making a social-engineering or drive-by-redirect step necessary for exploitation.

• Attack complexityDetail

  Attack complexity is high because the attacker must first have compromised the Chrome renderer process before the use-after-free can be leveraged for a sandbox escape, introducing a significant prerequisite condition.

Blast Radius

• An attacker who achieves the sandbox escape gains code execution outside the Chrome sandbox, reading files and credentials accessible to the browser process on the Windows host.
• The attacker can write or modify data on the host filesystem or in other processes accessible from outside the sandbox.
• The attacker can crash or destabilize the browser process or other host processes, disrupting service for the affected user.
• Because the scope change (S:C) is present in the CVSS vector, impact extends beyond the browser itself to other components sharing the same host.