CVE-2026-9949: Use after free in Core in Google Chrome on Windows prior to 148

Synopsis

A use-after-free vulnerability affects the Core component of Google Chrome on Windows in versions prior to 148.0.7778.216. The flaw is reachable over the network but requires the attacker to have already compromised the Chrome renderer process; a victim must interact with a crafted HTML page to trigger the condition. Successful exploitation allows the attacker to escape Chrome's sandbox, gaining execution capabilities beyond the browser's isolated environment. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network, requiring the victim's browser to reach or load attacker-controlled content.

• AuthenticationNot required

  No account or credentials are needed; the attacker operates as an anonymous remote party.

• Victim interactionRequired

  The victim must visit or be directed to a crafted HTML page, making this a social-engineering or drive-by-delivery scenario.

• Attack complexityDetail

  Exploitation requires the renderer process to already be compromised, introducing a chained precondition that depends on a prior exploit step or environmental factor.

Blast Radius

• Attacker escapes the Chrome sandbox and executes code outside the browser's isolated process, breaking the primary containment boundary on the host.
• With sandbox escape achieved, the attacker reads files and credentials accessible to the browser process user account on the Windows host.
• The attacker writes or modifies files and persisted data within the scope of that user account.
• The attacker can crash or disrupt the Chrome process and any dependent services running under the same session.