CVE-2026-9993: Use after free in Views in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the Views component of Google Chrome allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox via a crafted PDF file. The attack is reachable over the network but requires the victim to interact with a malicious file, and the CVSS score is 8.3 (High). Successful exploitation gives the attacker full read, write, and execution capability outside the Chrome sandbox, on the host system. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted PDF over the network, so the targeted Chrome instance must be reachable or the user must browse to an attacker-controlled resource.

• AuthenticationNot required

  No account or credentials are needed; the attacker only needs to get the victim to open a crafted PDF.

• Victim interactionRequired

  The victim must open or preview a crafted PDF file, making this a social-engineering-dependent exploit.

• Attack complexityDetail

  Attack complexity is High, meaning the attacker must have already compromised the Chrome renderer process before this use-after-free can be leveraged for sandbox escape.

Blast Radius

• Attacker gains code execution outside the Chrome sandbox, breaking the primary security boundary between web content and the host OS.
• Confidential data accessible to the browser process, including stored credentials, cookies, and session tokens, becomes readable by the attacker.
• The attacker can write to the filesystem and modify files accessible under the user account running Chrome.
• The attacker can crash or terminate host processes, disrupting any service running under the same user context.