CVE-2026-9984: Chrome Use-After-Free RCE on Windows

Technical summary

CVE-2026-9984 is a use-after-free vulnerability (CWE-416) in Google Chrome's user interface subsystem running on Windows platforms. The vulnerability stems from improper memory management where a UI object is accessed after it has been freed, allowing an attacker to control memory contents and achieve arbitrary code execution. The attack vector is network-based and requires only user interaction (visiting a malicious webpage), with no authentication or elevated privileges needed. Chromium has classified this as a High severity issue.

Business impact

Exploitation of this vulnerability could allow attackers to gain complete control of affected Chrome browser instances with the privileges of the logged-in user. This enables data theft from browser credentials, session tokens, and locally stored sensitive information; installation of malware or backdoors; lateral movement into corporate networks if the compromised user has elevated access; and potential disruption of business operations. Organizations with high numbers of Windows users running Chrome face elevated risk of targeted attacks and credential compromise.

Affected systems

Google Chrome on Microsoft Windows prior to version 148.0.7778.216 is affected. This includes all older stable releases and potentially Chrome on Windows 10, Windows 11, and earlier supported versions. Chrome on other operating systems (macOS, Linux, Android, iOS) is not affected by this specific vulnerability. Users should check their Chrome version under Settings > About Chrome to verify their current status.

Exploitability

This vulnerability has moderate exploitability barriers in practice despite a high CVSS score. An attacker must craft a malicious HTML page and convince or trick a user into visiting it—no self-propagating worm capability exists. However, the low complexity, lack of authentication requirements, and prevalence of social engineering make this a realistic threat in targeted campaigns. As of the published date, CVE-2026-9984 has not been added to the CISA Known Exploited Vulnerabilities catalog, suggesting limited public exploit activity at this time, though this does not guarantee future safety.

Remediation

Update Google Chrome to version 148.0.7778.216 or later immediately. Google Chrome's auto-update mechanism typically rolls out patches automatically, but users can force an update by visiting Settings > About Chrome. Organizations should verify deployment through enterprise management tools (Google Admin Console for Chrome OS/Browser, or third-party endpoint management platforms). No workarounds exist; patching is the only mitigation.

Patch guidance

Deploy Chrome version 148.0.7778.216 or any later stable release. For enterprise deployments, configure Chrome update policies to enable automatic updates or push patches through your mobile device management (MDM) or endpoint management solution. Verify patch deployment by auditing Chrome versions across your fleet using enterprise reporting tools. Test compatibility with critical web applications in your environment before forcing updates on all users, if needed, though this patch should be low-risk.

Detection guidance

Monitor for indicators of compromise including unusual child processes spawned from the Chrome executable, unexpected network connections from chrome.exe, and presence of suspicious browser extensions installed without user consent. Review browser history and downloaded files for indicators of malicious webpage visits. Endpoint Detection and Response (EDR) tools can alert on suspicious memory access patterns or process injection attempts targeting Chrome. Network-based detection is challenging but may identify command-and-control communication if malware is successfully deployed post-exploitation.

Why prioritize this

This vulnerability merits urgent patching due to its remote code execution capability, low attack complexity, and network accessibility. The requirement for user interaction is a meaningful control, but social engineering campaigns are effective and widespread. The CVSS score of 8.8 reflects the severity of potential impact (complete confidentiality, integrity, and availability compromise). Organizations should prioritize this patch within their standard critical vulnerability response timeline, typically 48–72 hours.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is driven by: (1) Network attack vector—the flaw is remotely exploitable with no special network positioning required; (2) Low attack complexity—no special conditions or tools are needed beyond a crafted webpage; (3) No privileges or authentication required; (4) User interaction required—the user must visit a malicious page, which is a mitigating factor; (5) Unchanged scope; (6) High impact on confidentiality, integrity, and availability through arbitrary code execution with user privileges. The score accurately reflects the practical risk for browser-based remote code execution.

Frequently asked questions