CVE-2026-9962: Use after free in WebRTC in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the WebRTC component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the Chrome sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is reachable over the network, requires no authentication, but does require the victim to load attacker-controlled content. A patched-image rebuild at Chrome 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page, so the victim's browser must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get a user to load the malicious page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering or malicious-ad delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• Executes arbitrary attacker-supplied code inside the Chrome renderer sandbox, giving the attacker control of the renderer process.
• Reads in-page data including session tokens, form contents, and any secrets accessible to the current browsing context.
• Modifies in-page state and can initiate network requests from the victim's browser session.
• Crashes or destabilizes the affected renderer process, disrupting the user's session.