CVE-2026-9948: Use after free in Views in Google Chrome on Mac prior to 148

Synopsis

A use-after-free vulnerability in the Views component of Google Chrome on macOS affects all versions prior to 148.0.7778.216. The bug is reachable over the network and requires no authentication, but the attacker must first compromise the renderer process and trick a user into visiting a crafted HTML page. Successful exploitation allows a sandbox escape, giving the attacker capabilities beyond the Chrome renderer sandbox including potential code execution in the broader macOS context. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target host must be reachable from an external or network-adjacent origin.

• AuthenticationNot required

  No account or credential of any privilege level is needed to deliver the malicious page to the victim.

• Victim interactionRequired

  The victim must open a crafted HTML page, requiring a social-engineering step such as a phishing link or a malicious ad redirect.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must first independently compromise the Chrome renderer process before the use-after-free can be used for a sandbox escape.

Blast Radius

• The attacker escapes the Chrome renderer sandbox, gaining execution context outside the browser's isolation boundary on macOS.
• With sandbox escape achieved, the attacker reads files and data accessible to the browser process, including stored credentials, cookies, and session tokens.
• The attacker can write or modify data on the filesystem or in application storage accessible under the current macOS user account.
• The attacker can crash or destabilize the browser process or dependent services, causing denial of service for the affected user session.