CVE-2026-9972: Uninitialized Use in Gamepad in Google Chrome on Mac prior to 148

Synopsis

Uninitialized memory use in the Gamepad component of Google Chrome on macOS allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network but requires the victim to interact with attacker-controlled content, and exploitation involves high attack complexity due to the prerequisite renderer compromise. Successful exploitation gives the attacker full read, write, and disruption capability beyond the sandbox boundary. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target service or browser must be reachable from a remote origin.

• AuthenticationNot required

  No authentication or account credentials are needed to deliver the malicious page to the victim.

• Victim interactionRequired

  The victim must visit or be directed to a crafted HTML page, making a social-engineering or drive-by delivery step necessary.

• Attack complexityDetail

  Exploitation requires the attacker to have already compromised the renderer process before the sandbox escape can be attempted, introducing a significant environmental prerequisite.

Blast Radius

• A successful attacker breaks out of the Chrome renderer sandbox on macOS, gaining execution capability in a broader host context.
• Confidentiality impact is high: the attacker reads data accessible outside the sandbox, including files and memory regions belonging to other processes.
• Integrity impact is high: the attacker writes or modifies data and can tamper with files or process state beyond the sandbox boundary.
• Availability impact is high: the attacker disrupts or crashes processes and services running outside the sandbox.