CVE-2026-9954: Use after free in TabStrip in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability exists in the TabStrip component of Google Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network but requires a victim to perform specific UI gestures on a crafted HTML page, and no authentication to the browser or any service is needed from the attacker's side. Successful exploitation causes heap corruption that gives an attacker full read access, write access, and the ability to crash or destabilize the browser process. A patched-image rebuild at Chrome 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No authentication to any service or account is required from the attacker; serving a malicious page is sufficient.

• Victim interactionRequired

  The victim must perform specific UI gestures on the crafted page, meaning the attacker must socially engineer the user into taking those actions.

• Attack complexityDetail

  Attack complexity is high, meaning exploitation depends on precise timing or environmental conditions such as heap layout, making reliable triggering non-trivial.

Blast Radius

• An attacker achieves heap corruption that enables reading arbitrary memory from the browser process, exposing stored session tokens, credentials, or page contents.
• Write primitives derived from the heap corruption allow an attacker to modify browser process memory, potentially redirecting execution flow.
• Full compromise of confidentiality, integrity, and availability of the browser process is achievable, including crashing or destabilizing Chrome entirely.
• Because the scope is contained to the browser process (S:U), the exploit does not directly escape the browser sandbox on its own, but memory read and write access within the process is a common stepping stone to further exploitation.