CVE-2026-9947: Use after free in XML in Google Chrome prior to 148

Synopsis

Use-after-free vulnerability in the XML processing component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to exploit freed memory by luring a user to a crafted HTML page, requiring no authentication. Successful exploitation gives the attacker arbitrary code execution inside the Chrome sandbox, enabling full control of the renderer process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target browser must be able to reach and load the crafted HTML page, so the Chrome instance must have outbound network access or the user must visit an attacker-controlled URL.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to load a page, which requires no prior authentication relationship.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome renderer sandbox, allowing full control of that renderer process.
• Confidential data accessible to the renderer, including page content, session cookies, and stored credentials surfaced by the browser, can be read.
• The attacker can tamper with rendered content, inject scripts, or perform actions on behalf of the user within the compromised tab.
• The renderer process can be crashed or kept in an attacker-controlled state, disrupting the user's browsing session for that origin.