CVE-2026-9937: Use after free in UI in Google Chrome on Windows prior to 148

Synopsis

Use-after-free in the UI layer of Google Chrome on Windows (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The attack is reachable over the network but requires the victim to visit or interact with attacker-controlled content, and exploitation is conditional on the renderer already being compromised, meaning this is typically chained with a separate renderer exploit. Successful exploitation gives the attacker code execution outside the Chrome sandbox, effectively running arbitrary code at the privilege level of the browser process on the victim's Windows host. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable or directed to an attacker-controlled origin.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated user browsing to the crafted page can be targeted.

• Victim interactionRequired

  The victim must visit or otherwise interact with a crafted HTML page, introducing a social-engineering step for the attacker.

• Attack complexityDetail

  Exploitation is rated AC:H because it depends on the renderer process already being compromised, typically through a separate chained vulnerability, before this use-after-free can be triggered for the sandbox escape.

Blast Radius

• Attacker executes arbitrary code outside the Chrome sandbox at the privilege level of the browser process on the victim's Windows host.
• Confidential data accessible to the browser process, including stored credentials, session cookies, and local files readable by that user, is exposed to the attacker.
• The attacker can write to or modify files and registry entries accessible to the browser process user account.
• The browser process and dependent services can be crashed or made unavailable on the affected host.