CVE-2026-9933: Use after free in Input in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the Input handling component of Google Chrome allows a remote attacker to corrupt heap memory. The attacker must reach the victim over the network and convince them to perform specific UI gestures on a crafted HTML page; no authentication is required. Successful exploitation gives the attacker read access to sensitive memory contents, the ability to modify memory state, and the ability to crash or hijack the browser process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, requiring the victim's browser to be reachable or for the victim to browse to an attacker-controlled URL.

• AuthenticationNot required

  No account or credentials on any system are needed; the attack is launched entirely through a web page served to an unauthenticated visitor.

• Victim interactionRequired

  The attacker must convince the victim to perform specific UI gestures (such as clicks or input sequences) on the crafted page, making a social-engineering step necessary.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for environmental factors such as heap memory layout or timing conditions to trigger the use-after-free reliably.

Blast Radius

• A successful exploit reads heap memory contents from the browser process, exposing stored credentials, session tokens, or page data.
• The attacker can write to freed heap memory, modifying browser state or injecting attacker-controlled data into live objects.
• Full compromise of the renderer or browser process is achievable, enabling arbitrary code execution in the context of the Chrome process.
• The browser process can be crashed, causing a denial of service for the affected user session.