CVE-2026-9961: Use after free in SurfaceCapture in Google Chrome prior to 148

Synopsis

Use-after-free in the SurfaceCapture component of Google Chrome affects all versions prior to 148.0.7778.216. The vulnerability is reachable over the network and requires no authentication, but the target user must visit a crafted HTML page. Successful exploitation corrupts heap memory, giving an attacker read access to sensitive data, the ability to modify memory contents, and the ability to crash or take control of the affected process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the target to a crafted HTML page served from a remote host.

• AuthenticationNot required

  No account or credential is needed; the exploit is accessible to any unauthenticated network peer who can reach the target browser.

• Victim interactionRequired

  The target user must actively visit the attacker-controlled HTML page, making social-engineering delivery (phishing link, malicious ad, redirect) a prerequisite.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors outside the attacker's control.

Blast Radius

• Heap corruption grants the attacker the ability to read process memory, exposing session tokens, credentials, or other sensitive browser data.
• The attacker can write arbitrary values into heap memory, modifying in-process data structures or injecting executable code.
• The affected Chrome renderer or browser process can be crashed, disrupting the user's session and any dependent services.
• Full compromise of the renderer process is achievable, enabling further privilege-escalation attempts against the underlying operating system.