CVE-2026-9995: Use after free in WebXR in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability exists in the WebXR component of Google Chrome prior to version 148.0.7778.216. The flaw is reachable over the network without any authentication, but requires a user to visit or be redirected to a crafted HTML page. Successful exploitation gives an attacker arbitrary code execution inside the Chrome sandbox. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the crafted HTML page over the network, meaning the target Chrome instance must be reachable in a browsing context exposed to attacker-controlled content (AV:N).

• AuthenticationNot required

  No account or credentials are needed; the attacker only needs to get the target to load a page (PR:N).

• Victim interactionRequired

  The target user must visit or be directed to the attacker's crafted HTML page, making this a social-engineering or drive-by scenario (UI:R).

• Attack complexityDetail

  Exploitation is reliable and imposes no special environmental conditions or race-condition requirements on the attacker (AC:L).

Blast Radius

• The attacker executes arbitrary code within the Chrome renderer sandbox, gaining full control over the compromised browser process.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and page content, is exposed to the attacker.
• The attacker can write or modify data within the sandbox, including cached files and browser state.
• The affected browser process can be crashed or forced into an unrecoverable state, disrupting the user's session.