CVE-2026-9978: Use after free in Glic in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the Glic component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the browser sandbox. The flaw is reachable over the network and requires no authentication, but the victim must visit a crafted HTML page. Successful exploitation gives the attacker code execution within the sandboxed renderer process. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable by the user browsing to an attacker-controlled URL.

• AuthenticationNot required

  No credentials or account are needed; any anonymous remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector that requires luring the user to attacker-controlled content.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no specific race condition, memory layout, or other environmental precondition to trigger.

Blast Radius

• The attacker executes arbitrary code within the Chrome sandboxed renderer process.
• Confidentiality impact is high: the attacker reads data accessible to the renderer, including page contents, stored credentials surfaced by autofill, and session tokens.
• Integrity impact is high: the attacker modifies data processed by the renderer, including DOM state and any data written back to web storage or transmitted via network requests.
• Availability impact is high: the attacker crashes or destabilizes the affected renderer process, taking down the browser tab or triggering a full browser crash.