CVE-2026-9934: Use after free in Aura in Google Chrome prior to 148

Synopsis

Use-after-free in the Aura UI framework component of Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker to execute arbitrary code on the victim's machine. The vulnerability is reachable over the network but requires the attacker to convince a target user to perform specific UI gestures, typically through a crafted HTML page delivered via a malicious or compromised site. Successful exploitation gives the attacker full code execution in the context of the browser process. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be able to reach attacker-controlled content via a standard internet connection.

• AuthenticationNot required

  No account or credentials are required; the attacker only needs to lure the target to a malicious page.

• Victim interactionRequired

  The victim must perform specific UI gestures on the crafted page, making social engineering a necessary step in the attack chain.

• Attack complexityDetail

  Exploit reliability is reduced by high attack complexity, meaning the attacker likely depends on specific browser state, memory layout, or timing conditions to trigger the use-after-free reliably.

Blast Radius

• Attacker executes arbitrary code in the context of the Chrome browser process on the victim's machine.
• Confidentiality impact is high: the attacker can read browser memory, stored credentials, session tokens, and other data accessible to the process.
• Integrity impact is high: the attacker can write or modify data within the process and interact with the underlying OS at the browser's privilege level.
• Availability impact is high: the attacker can crash the browser process or render it unresponsive.