CVE-2026-9936: Use after free in GFX in Google Chrome on Mac prior to 148

Synopsis

A use-after-free vulnerability in the GFX (graphics) component of Google Chrome on macOS affects all versions prior to 148.0.7778.216. The flaw is reachable over the network but requires the attacker to have already compromised the Chrome renderer process, and a victim must interact with a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker code execution outside the browser sandbox with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by delivering a crafted HTML page, exposing the attack surface to any internet-accessible browser session.

• AuthenticationNot required

  No authentication is required; the attacker does not need any account or credential on the target system.

• Victim interactionRequired

  A victim must visit or otherwise interact with a crafted HTML page, meaning the attacker depends on a social-engineering or drive-by delivery step.

• Attack complexityDetail

  Attack complexity is HIGH, meaning the attacker must first achieve renderer-process compromise before the use-after-free can be leveraged for a sandbox escape, introducing a significant prerequisite step.

Blast Radius

• A successful attacker escapes the Chrome browser sandbox on macOS, gaining code-execution rights outside the renderer's restricted environment.
• With sandbox escape achieved, the attacker reads files and data accessible to the browser process, including cookies, stored credentials, and local profile data.
• The attacker can write to or modify files and system state reachable by the browser process user account.
• The attacker can crash or destabilize the browser process and dependent services, causing denial of service to the affected session.