CVE-2026-9939: Heap buffer overflow in WebCodecs in Google Chrome prior to 148

Synopsis

A heap buffer overflow in the WebCodecs component of Google Chrome before version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, only a single user interaction (visiting a malicious page). Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, enabling further attacks depending on sandbox escape capability. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable via normal browser traffic.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated user who visits the attacker-controlled page is a valid target.

• Victim interactionRequired

  The victim must open a crafted HTML page, meaning the attacker relies on social engineering or a malicious link to trigger the overflow.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control of the sandboxed process.
• Files, cookies, and session tokens accessible to the renderer process can be read or exfiltrated.
• Sandboxed process memory and state can be modified, enabling manipulation of page content and local data visible to that process.
• If combined with a separate sandbox-escape primitive, the attacker gains code execution at the OS user level of the Chrome process owner.