CVE-2026-9973: Out of bounds write in V8 in Google Chrome prior to 148

Synopsis

An out-of-bounds write vulnerability in V8, the JavaScript engine embedded in Google Chrome, affects all Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives a remote attacker arbitrary code execution inside Chrome's sandbox. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable via normal browser traffic.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or be socially engineered into visiting the attacker-controlled HTML page for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout dependencies, or other environmental prerequisites.

Blast Radius

• The attacker executes arbitrary code within the Chrome renderer sandbox, gaining full control of the sandboxed process.
• Confidential data processed by the browser, including stored credentials, session tokens, and page content, is exposed to the attacker.
• The attacker can write to memory regions accessible within the sandbox, enabling modification of in-process state and data.
• The affected Chrome process can be crashed or destabilized, causing loss of browser availability for the user.