CVE-2026-9945: Chrome Media Use-After-Free RCE on Windows

Technical summary

CVE-2026-9945 is a use-after-free (CWE-416) flaw in Chrome's media subsystem affecting Windows deployments prior to version 148.0.7778.216. The vulnerability allows remote code execution within the Chrome sandbox via crafted HTML markup. The CVSS v3.1 score of 8.8 (HIGH) reflects the combination of network-based attack vector, low attack complexity, no privilege requirement, and user interaction as the sole precondition. While execution occurs in the sandbox, successful exploitation still permits reading, modifying, and disabling application functionality.

Business impact

Chrome users on Windows remain at risk of malware infection, data theft, and credential compromise through drive-by attacks on compromised or attacker-controlled websites. Organizations relying on Chrome for web access face potential data exfiltration and lateral movement staging points, particularly if sandbox escape techniques are chained with this vulnerability. Delayed patching extends the window for mass exploitation before users update.

Affected systems

Google Chrome on Windows versions prior to 148.0.7778.216 are affected. This spans millions of Windows users globally, including enterprise deployments where Chrome is used for web applications and cloud services. The vulnerability does not affect Chrome on macOS, Linux, or other platforms, nor does it affect other Chromium-based browsers unless they have independently merged the vulnerable code and backported it.

Exploitability

Exploitability is high in practice. An attacker needs only to host a malicious HTML page and direct users to it—no zero-click delivery, no network proximity requirement, and no authentication. The user interaction barrier is low: visiting a webpage qualifies. Once a victim lands on the page, the crafted media element can trigger the use-after-free condition and execute arbitrary code. The sandbox constraint limits but does not eliminate impact; sandbox escapes, though harder, have been demonstrated in the past.

Remediation

Update Google Chrome to version 148.0.7778.216 or later on all Windows systems. Verify update deployment through Chrome's automatic update mechanism or manual update prompts. Organizations should enforce Chrome updates via managed device policies (e.g., Group Policy on Windows domains) to ensure rapid coverage. Until patched, users should avoid untrusted websites and disable JavaScript if feasible for high-risk browsing.

Patch guidance

Google Chrome ships automatic updates; most users will receive version 148.0.7778.216 within hours of release. Enterprise administrators should verify rollout through Chrome Management console or by checking chrome://version on managed devices. For air-gapped or restricted environments, manually download the installer from Google's official update server. Test the patch on a non-critical system first to confirm media functionality (video playback in web applications) remains intact.

Detection guidance

Monitor Chrome crash logs and crash reports for segmentation faults or memory corruption patterns in the media component (look for module names like 'media_service.dll' or stack traces involving 'MediaService'). Endpoint detection and response (EDR) tools should flag unusual process execution spawned from Chrome or suspicious child processes. Network-based detection is limited unless you inspect encrypted TLS traffic; focus on identifying compromised websites distributing malicious HTML via threat intelligence feeds or web proxy logs showing visits to known-malicious domains.

Why prioritize this

This vulnerability merits high priority due to its high CVSS score (8.8), practical exploitability via simple user interaction, and lack of KEV status (meaning no in-the-wild active exploitation has yet been formally confirmed, but that does not lower the threat). The large installed base of Chrome on Windows means widespread risk. Immediate patching is justified to prevent opportunistic attacks while the exploit window remains narrow.

Risk score, explained

The CVSS v3.1 score of 8.8 (HIGH) reflects: network-based attack vector (AV:N) requiring no special network position; low attack complexity (AC:L) given the straightforward nature of hosting a malicious page; no privilege requirement (PR:N); mandatory user interaction (UI:R) as the sole gate; unchanged scope (S:U) with no privilege escalation beyond the user's own session; and high confidentiality, integrity, and availability impact (C:H/I:H/A:H) within the sandbox. The sandbox does not lower the CVSS score because the vector assumes impact to the affected resource (the browser process and its data).

Frequently asked questions