CVE-2026-9988: Use after free in WebRTC in Google Chrome on Linux prior to 148

Synopsis

Use-after-free in the WebRTC component of Google Chrome on Linux, affecting all versions prior to 148.0.7778.216. The vulnerability is reachable over the network and requires no authentication, though the attacker must convince a user to visit a crafted HTML page; CVSS scores this at 8.3 High. Successful exploitation allows a remote attacker to escape the Chrome sandbox, gaining the ability to read, modify, or disrupt data beyond the browser's isolation boundary. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credentials on the target system are needed; the attack is fully unauthenticated.

• Victim interactionRequired

  The victim must be socially engineered into visiting a crafted HTML page, making user interaction a prerequisite for exploitation.

• Attack complexityDetail

  CVSS rates this AC:H, meaning the exploit depends on conditions beyond the attacker's direct control, such as timing, memory layout, or specific runtime state in the WebRTC component.

Blast Radius

• A successful sandbox escape lets the attacker execute code outside Chrome's sandboxed renderer, gaining access to the underlying Linux user session.
• High confidentiality impact means the attacker reads files, credentials, and session data accessible to the browser process owner.
• High integrity impact means the attacker writes or modifies files and system state outside the browser sandbox.
• High availability impact means the attacker can crash or disrupt the host process and dependent services.