CVE-2026-9962: Google Chrome WebRTC Use-After-Free Remote Code Execution

Technical summary

CVE-2026-9962 is a use-after-free vulnerability (CWE-416) in the WebRTC subsystem of Google Chrome versions prior to 148.0.7778.216. The vulnerability occurs when memory that has been freed is accessed again, allowing an attacker to manipulate the freed memory region and achieve code execution within the Chrome sandbox. The attack requires user interaction (visiting a malicious webpage) and network access, but no prior authentication or elevated privileges. The Chromium security team classified this as High severity.

Business impact

Exploitation of this vulnerability could allow attackers to steal sensitive user data (credentials, personal information, browsing history) from within the browser sandbox, modify data during active sessions, or cause denial of service. For organizations where employees use Chrome to access internal systems or sensitive cloud applications, this vulnerability represents a direct threat to data confidentiality and integrity. Widespread exploitation could drive incident response costs and damage to customer trust.

Affected systems

Google Chrome versions before 148.0.7778.216 are vulnerable across all supported operating systems, including Microsoft Windows, macOS, and Linux. Users on earlier stable releases, extended stable channels, or unpatched Chrome instances remain at risk. Chromebooks and Chrome OS devices using vulnerable releases are also affected, though the sandbox provides some mitigation of impact.

Exploitability

This vulnerability has relatively low friction for exploitation. An attacker need only craft a malicious HTML page and trick a user into visiting it through phishing, drive-by download, or ad injection—no advanced social engineering required. The requirement for user interaction (visiting a webpage) is a baseline expectation for web-based attacks. The CVSS score of 8.8 reflects the high impact (confidentiality, integrity, and availability all compromised) combined with the low attack complexity and lack of privilege requirements. No public exploit code has been documented in the KEV catalog at this time.

Remediation

Update Google Chrome to version 148.0.7778.216 or later immediately. Chrome's auto-update mechanism will push the patch to most users, but verification is recommended for enterprise deployments. Users unable to update immediately should restrict access to untrusted websites and consider disabling WebRTC features if operationally feasible. Organizations should verify patch deployment across all managed Chrome instances and enforce updates in group policies where applicable.

Patch guidance

Google Chrome users should verify they are running version 148.0.7778.216 or later by navigating to Chrome Menu > About Google Chrome, which will automatically check for updates. Enterprise administrators can verify patching status via Chrome management console and should set auto-update policies to ensure timely deployment. Users of Chromebooks should check Settings > About > Chrome OS to confirm they are on the latest build. For Windows, macOS, and Linux desktop users, allow the browser to complete its update cycle and relaunch when prompted.

Detection guidance

Security teams should monitor for Chrome version compliance in their environment using endpoint management tools or browser telemetry. Network-based detection is difficult because the attack payload is contained within an HTML page; focus instead on endpoint signals such as unexpected Chrome process crashes or sandbox escapes. Correlation with phishing campaigns or suspicious website visits may provide contextual indicators. User reports of unusual browser behavior after visiting unfamiliar links should be investigated as potential exploitation attempts.

Why prioritize this

This vulnerability merits immediate patching because it combines high impact (arbitrary code execution with full read/write/crash capability), low attack friction (user clicks a link), and wide distribution (affects all Chrome users). The use-after-free class of vulnerability is well-understood by sophisticated attackers and historically has seen rapid weaponization. Although not yet listed in the KEV catalog, the combination of high CVSS score (8.8), user-facing attack surface, and Chromium's high-severity classification warrants priority treatment in any patch management program.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability with low attack complexity, no privilege requirements, and user interaction required. All three impact vectors (confidentiality, integrity, availability) are marked as high because a successful exploit allows the attacker to exfiltrate data, modify content in memory, and crash the browser. The scope is unchanged (attack and impact remain within Chrome sandbox). This score correctly represents the real-world risk posed by an actively exploitable, remotely triggerable memory corruption flaw in widely deployed software.

Frequently asked questions