CVE-2026-9923: Use after free in Skia in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability exists in Skia, the graphics rendering library embedded in Google Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network without any account or login, but requires the target user to visit a crafted HTML page. Successful exploitation gives an attacker the ability to read sensitive data from memory, tamper with process memory, or crash the browser, any of which can escalate to remote code execution through heap corruption. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by getting the victim to load a remote crafted HTML page, so the Chrome instance must be reachable by normal web browsing.

• AuthenticationNot required

  No account, login, or credential of any kind is required; the attack works against any user who visits the malicious page.

• Victim interactionRequired

  The target user must actively open or be redirected to a crafted HTML page, making social engineering or a malicious ad/link a prerequisite.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• An attacker reads arbitrary heap memory from the Chrome renderer process, which may include session tokens, cached credentials, or page content.
• An attacker writes to freed heap memory, allowing modification of in-process data structures and potential control-flow hijacking leading to remote code execution.
• The renderer process crashes if heap corruption is not controlled precisely, causing a denial of service for the affected browser tab or the entire browser.
• Because the scope is unchanged (S:U), impact is contained to the Chrome process itself, but code execution within that process still exposes all data the browser can access.