CVE-2026-9990: Use after free in WebAppInstalls in Google Chrome on Mac prior to 148

Synopsis

A use-after-free vulnerability affects Google Chrome on macOS in the WebAppInstalls component, present in versions prior to 148.0.7778.216. The flaw is reachable over the network but requires a victim to perform specific UI gestures after visiting a crafted HTML page; no authentication is needed from the attacker. Successful exploitation corrupts heap memory, enabling an attacker to read sensitive data, tamper with it, or crash the browser process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page, so the victim's browser must be able to reach the attacker-controlled host.

• AuthenticationNot required

  No account or credential is needed on any system; the attacker only needs to get the victim to visit a page.

• Victim interactionRequired

  The victim must perform specific UI gestures in the browser after loading the crafted page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is high, meaning reliable exploitation depends on timing, heap layout, or other environmental factors that the attacker cannot fully control.

Blast Radius

• A successful attacker reads high-confidentiality browser data such as stored credentials, session tokens, and page content from the renderer process.
• The attacker can modify in-memory data structures, enabling tampering with rendered content or injecting behavior into the running browser session.
• Heap corruption crashes the affected Chrome process, causing loss of the current browsing session and any unsaved state.
• All three impacts can occur in a single exploitation attempt, giving the attacker a broad foothold within the browser's security boundary on the affected Mac host.