CVE-2026-9997: Use after free in Input in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the Input component of Google Chrome (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox by delivering a crafted HTML page. The attack requires the victim to interact with the page and benefits from the renderer already being under attacker control, but no authentication is needed. Successful exploitation grants the attacker code execution outside the browser sandbox, enabling full compromise of the host process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target service or user must be reachable from the internet or an accessible network segment.

• AuthenticationNot required

  No account or credential is required; the attack is initiated by getting the victim to load a malicious page.

• Victim interactionRequired

  The victim must navigate to or open the attacker-controlled HTML page, making this a social-engineering step the attacker must accomplish.

• Attack complexityDetail

  Exploitation is rated High complexity because it requires the renderer process to already be compromised before the use-after-free can be leveraged for a sandbox escape, introducing a significant prerequisite condition.

Blast Radius

• An attacker who succeeds reads memory outside the browser sandbox, exposing secrets, credentials, and session data held in other browser processes or the host OS.
• The attacker can write to host-level resources, modifying files, registries, or process memory outside the sandboxed renderer.
• The attacker gains arbitrary code execution in the context of the Chrome browser process on the host, not just inside the sandboxed tab.
• Full sandbox escape means the attacker can crash, persist on, or pivot from the affected host to other systems on the same network.