CVE-2026-9922: Use after free in GPU in Google Chrome on Mac prior to 148

Synopsis

A use-after-free vulnerability in the GPU component of Google Chrome on macOS affects all Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network but requires the attacker to have already compromised the renderer process and to trick a user into visiting a crafted HTML page. Successful exploitation enables arbitrary code execution on the affected host. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credential is needed on the targeted system; the attacker operates as an unauthenticated remote party.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must socially engineer or redirect the user to attacker-controlled content.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must have already compromised the renderer process before triggering the GPU use-after-free, introducing a significant pre-condition.

Blast Radius

• An attacker who triggers the vulnerability executes arbitrary code in the context of the Chrome process on the victim's Mac.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and locally cached files, can be read.
• An attacker can write to or modify data reachable by the browser process, including browser storage and any files the process has write access to.
• The browser process can be crashed or forced into an unrecoverable state, denying service to the user.