CVE-2026-9945: Use after free in Media in Google Chrome on Windows prior to 148

Synopsis

Use-after-free in the Media component of Google Chrome on Windows affects versions prior to 148.0.7778.216. The vulnerability is reachable over the network without any authentication, but requires the target user to visit a specially crafted HTML page. Successful exploitation lets a remote attacker execute arbitrary code inside the Chrome sandbox. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target only needs to load a page the attacker controls.

• AuthenticationNot required

  No account or credential of any kind is needed; the attack works against any unauthenticated browser session.

• Victim interactionRequired

  The target user must visit a crafted HTML page, making this a social-engineering vector that relies on the user clicking a link or being redirected.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race condition, memory layout dependency, or other environmental precondition.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox on the victim's Windows host.
• Confidential data accessible to the browser process, such as stored credentials, session tokens, and page content, is exposed to the attacker.
• The attacker can write or modify data within the sandbox's reach, including cached files and browser-accessible storage.
• The affected Chrome process can be crashed or rendered unresponsive, disrupting the user's browsing session.