CVE-2026-9897: Chrome DOM Use-After-Free Code Execution Vulnerability (High CVSS 8.8)

Technical summary

CVE-2026-9897 is a use-after-free memory safety vulnerability (CWE-416) in Chrome's DOM implementation. The flaw allows an unauthenticated remote attacker to craft a malicious HTML page that, when visited by a user, triggers improper memory handling in the browser's rendering engine. While execution occurs within Chrome's sandbox isolation layer, the vulnerability still permits arbitrary code execution within that sandbox context. The attack vector is network-based with low complexity, requiring only that a user visits the attacker's page or clicks a link.

Business impact

Successful exploitation could lead to data theft from the user's browsing session (credentials, sensitive documents, cookies), malware installation on the user's system if the sandbox is bypassed in combination with other vulnerabilities, or denial of service of the browser. For organizations, this increases risk to employees who browse the internet and could facilitate targeted phishing or drive-by download attacks against your workforce.

Affected systems

Google Chrome on Windows, macOS, and Linux systems running versions before 148.0.7778.216 are vulnerable. All users of Chrome, Chromium-based browsers using affected Chromium versions, and systems that auto-update may still be at risk until the update is fully deployed. The vulnerability does not affect non-Chromium browsers.

Exploitability

While the vulnerability requires user interaction (visiting a malicious site), the attack surface is broad since web browsing is ubiquitous and attackers can use common phishing, social engineering, or compromised websites to distribute the exploit. The technical barrier to exploitation is moderate—an attacker would need to craft a specialized HTML page—but publicly available information on DOM-based use-after-free techniques makes development feasible for capable threat actors. The vulnerability is not currently tracked in the CISA KEV catalog, suggesting active exploitation in the wild has not been widely reported or confirmed at publication time.

Remediation

Update Google Chrome to version 148.0.7778.216 or later. Automatic updates are the primary remediation path for most users; verify update status in Chrome Settings > About Google Chrome. For enterprise environments, deploy updates via MDM or Group Policy to ensure endpoint compliance. Until patches are applied, educate users to avoid clicking suspicious links and to keep Chrome updated.

Patch guidance

Users should update to Chrome version 148.0.7778.216 or any subsequent release. Verify the update version in Settings > About Google Chrome, which should trigger an automatic update check if running an older version. Organizations managing Chrome deployment should prioritize this update in their patch management workflow, particularly for roles with elevated data access. Test the patched version in your environment before rolling out broadly if you have custom extensions or web applications.

Detection guidance

Monitor for Chrome processes spawning with unusual child processes or network connections following page loads. Look for browser crashes or unexpected memory access violations in Chrome logs. Endpoint Detection and Response (EDR) solutions should flag suspicious DOM manipulation attempts or post-exploitation activity originating from browser processes. Network-level detection is limited since the exploit is delivered via HTTPS; focus on behavioral indicators post-successful compromise. Check for signs of credential harvesting or unexpected browser plugin installations.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.8), network accessibility, and low attack complexity. Although it requires user interaction, the combination of confidentiality, integrity, and availability impact makes it a priority. The absence from the CISA KEV catalog does not diminish risk; organizations should assume capable attackers will develop and use exploits. Prioritize deployment in environments where users frequently browse untrusted content or receive phishing attacks.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a high-severity vulnerability: network-based attack vector (AV:N) with low complexity (AC:L), no privilege requirement (PR:N), and user interaction (UI:R) combines with high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The sandboxed execution context provides some mitigation compared to full system compromise, but arbitrary code execution within the browser sandbox still permits significant data theft and malware installation risks.

Frequently asked questions