CVE-2026-9951: Use after free in UI in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the UI component of Google Chrome affects all versions prior to 148.0.7778.216. The flaw is reachable over the network but requires a victim to interact with a crafted HTML page; no authentication is needed. Successful exploitation allows a remote attacker to escape Chrome's sandbox, gaining the ability to read sensitive data, modify files, and crash processes outside the browser's normal security boundary. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target over the network, delivering the crafted HTML page through a standard browser request.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  A victim must visit or be redirected to the attacker-controlled HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for race conditions or other environmental factors that make reliable triggering non-trivial.

Blast Radius

• A successful attacker escapes the Chrome sandbox and gains code execution in the context of the host process, reading files and secrets accessible to the browser's OS-level user.
• The attacker can write or modify files on the host, including credential stores, configuration files, or application data outside the browser sandbox.
• The attacker can crash or destabilize host-level processes, causing service disruption beyond the browser tab boundary.
• Because scope is changed (S:C in the CVSS vector), impact extends beyond the sandboxed component to other resources on the same host or container.