CVE-2026-9931: Use after free in GPU in Google Chrome prior to 148

Synopsis

Use-after-free in the GPU component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox via a crafted HTML page. The attack is reachable over the network, requires no authentication, but does require the victim to visit or interact with a malicious page, and carries high complexity due to the prerequisite renderer compromise. Successful exploitation gives the attacker full read, write, and crash capability outside the sandbox, effectively granting arbitrary code execution on the host. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network, requiring the victim's browser to reach or be directed to attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can attempt delivery of the crafted HTML page.

• Victim interactionRequired

  The victim must visit or otherwise interact with a crafted HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is high because exploitation presupposes a prior renderer process compromise, introducing significant environmental and sequencing dependencies before the sandbox escape can be attempted.

Blast Radius

• A successful attacker escapes Chrome's renderer sandbox and gains code execution in the context of the host process, bypassing the primary isolation boundary Chrome depends on.
• Full confidentiality impact means the attacker reads data accessible to the browser process, including stored credentials, session tokens, and local profile data.
• Full integrity impact means the attacker writes or modifies files and memory outside the sandbox, enabling persistent implants or tampering with local application state.
• Full availability impact means the attacker crashes or disrupts not just the browser tab but the broader host-level process, causing service loss on the affected system.