CVE-2026-9994: Use after free in Core in Google Chrome on Windows prior to 148

Synopsis

A use-after-free vulnerability in the Core component of Google Chrome on Windows (versions before 148.0.7778.216) allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox by delivering a crafted HTML page. The exploit requires the victim to interact with attacker-controlled content and involves high attack complexity due to the prerequisite renderer compromise. Successful exploitation gives the attacker code execution outside the browser sandbox, effectively breaking the primary isolation boundary between web content and the host OS. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target service or user must be reachable from an external or network-adjacent origin.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the victim to load the malicious page.

• Victim interactionRequired

  The victim must navigate to or otherwise load a crafted HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Attack complexity is rated High because the attacker must first achieve a renderer process compromise before this use-after-free can be leveraged for a sandbox escape.

Blast Radius

• Reads sensitive data from memory outside the renderer sandbox, including session tokens, credentials, or other in-process secrets.
• Writes to or modifies host OS resources that the Chrome sandbox would normally block, such as filesystem paths or registry keys.
• Crashes or destabilizes the Chrome process, causing a denial of service for the affected user session.
• Achieves arbitrary code execution on the underlying Windows host, fully breaking Chrome sandbox isolation.