CVE-2026-9992: Use after free in Network in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the Network component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the Chrome sandbox. The flaw is reachable over the network without any authentication, but requires the victim to visit a crafted HTML page. Successful exploitation gives the attacker arbitrary code execution within the browser sandbox, which can be chained with a sandbox escape for deeper system access. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach an attacker-controlled or compromised web server.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the victim to load a crafted page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the malicious HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• The attacker gains arbitrary code execution within the Chrome renderer sandbox, enabling them to run attacker-supplied instructions inside the browser process.
• With sandbox-level code execution established, the attacker can read browser memory, including cached credentials, session tokens, and form-autofill data.
• Integrity of browser state is fully compromised: the attacker can modify in-memory page content, intercept requests, and inject data into the browser's network layer.
• A successful sandbox escape chained onto this vulnerability would extend access to the host operating system, affecting availability of the host service.