CVE-2026-9952: Use after free in WebAudio in Google Chrome prior to 148

Synopsis

Use-after-free in the WebAudio component of Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though the victim must visit an attacker-controlled page. Successful exploitation gives the attacker code execution within the browser sandbox. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by hosting a crafted HTML page that the victim's browser fetches remotely.

• AuthenticationNot required

  No account or credential is needed on any system; the attacker only needs to get the victim to load a page.

• Victim interactionRequired

  The victim must navigate to or be redirected to an attacker-controlled HTML page, making this a social-engineering or malvertising vector.

• Attack complexityDetail

  Exploit complexity is low - no race conditions, memory-layout dependencies, or special environmental conditions are required for reliable exploitation.

Blast Radius

• Attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control of the sandboxed process.
• Confidential data accessible to the browser context, including stored session tokens, page contents, and in-memory credentials, is readable by the attacker.
• The attacker can write or modify data within the sandboxed process, including manipulating in-page state and any data the renderer can reach.
• The affected browser process can be crashed or destabilized, disrupting service for the user session.