CVE-2026-9984: Use after free in UI in Google Chrome on Windows prior to 148

Synopsis

A use-after-free vulnerability in the UI component of Google Chrome on Windows allows a remote attacker to execute arbitrary code. The flaw is reachable over the network without any authentication, but requires the victim to visit a crafted HTML page. Successful exploitation gives the attacker full code execution in the context of the browser process, enabling data theft, system tampering, or further compromise. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be able to reach and render an attacker-controlled HTML page.

• AuthenticationNot required

  No account, credential, or prior authentication is needed on the target system to trigger the vulnerability.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering vector (for example, a phishing link or a malicious ad).

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Attacker executes arbitrary code in the browser process, gaining the ability to read files, session tokens, saved passwords, and other data accessible to the browser.
• Attacker can write or modify files and registry entries within the permissions of the browser process user.
• Attacker can crash or hang the browser, denying service to the affected user.
• With code execution established, the attacker can pivot to further compromise the underlying Windows host depending on sandbox escape opportunities.