CVE-2026-9995: Chrome WebXR Use-After-Free Code Execution Vulnerability

Technical summary

CVE-2026-9995 is a use-after-free (CWE-416) vulnerability in Chrome's WebXR module. The flaw occurs when the WebXR implementation fails to properly manage memory for objects during the rendering or session lifecycle, allowing freed memory to be accessed and manipulated. An attacker exploits this by delivering a specially crafted HTML page that triggers object deallocation followed by unauthorized access to that memory region. The vulnerability requires user interaction (visiting the malicious page) but operates with network-level accessibility and no privilege requirements, resulting in a CVSS 3.1 score of 8.8 (HIGH). Chromium's internal severity assessment also classifies this as High.

Business impact

This vulnerability enables arbitrary code execution within the Chrome sandbox on any system running an affected version. While the sandbox contains damage to the renderer process, a sandbox escape combined with other flaws or the execution of malicious payloads (credential theft, data exfiltration, cryptomining) poses significant risk to enterprise users and consumers. Organizations relying on Chrome for security-sensitive tasks face potential data compromise. Browser-based attacks are particularly dangerous because they bypass perimeter controls and exploit trusted, daily-use software.

Affected systems

Google Chrome versions prior to 148.0.7778.216 on all platforms: Microsoft Windows, Apple macOS, and Linux systems are affected. Chrome is also available on Android and iOS, so verify platform-specific patch availability. Any device running an unpatched Chrome version is exposed when users visit malicious or compromised websites.

Exploitability

The vulnerability requires user interaction (clicking a link or visiting a page) but needs no special privileges or complex environment setup. Network accessibility is unrestricted. An attacker can host the malicious HTML on a public server or inject it into compromised legitimate websites. The barrier to exploitation is low; the primary mitigation is keeping Chrome up to date. No public exploit code is known to be weaponized, but the simplicity of the attack vector means exploitation is likely if patches lag adoption.

Remediation

Update Google Chrome to version 148.0.7778.216 or later immediately. Verify that automatic updates are enabled in your organization's Chrome deployment. For managed environments, configure update policies to enforce timely patching. Users can manually check for updates via Chrome menu > Settings > About Google Chrome, which triggers an immediate update check.

Patch guidance

Deploy Chrome 148.0.7778.216 or later across all systems. For enterprise environments, use Google's Chrome Enterprise support or mobile device management (MDM) platforms to enforce updates. Verify the patch version against Google's official security updates page (https://chromereleases.googleblog.com/) before deployment. Consider blocking older Chrome versions from accessing sensitive resources if your infrastructure supports it.

Detection guidance

Monitor Chrome version inventory using endpoint detection and response (EDR) tools, MDM platforms, or software asset management systems to identify clients still running versions prior to 148.0.7778.216. Enable browser telemetry logging where available. Security teams cannot reliably detect exploitation attempts after the fact (the sandbox restricts visible artifacts), so prevention through patching is critical. Watch for anomalous child process spawning from Chrome if sandbox escapes occur.

Why prioritize this

This vulnerability scores 8.8/10 (HIGH) due to unrestricted network accessibility, low attack complexity, requirement for only user interaction, and impact on all three confidentiality, integrity, and availability. Chrome's ubiquity means millions of devices may be exposed. The WebXR module is increasingly common as VR/AR adoption grows, expanding the attack surface. Though not yet on the CISA KEV catalog, the combination of high CVSS, ease of exploitation, and mainstream target makes this a top-tier patching priority.

Risk score, explained

CVSS 3.1 score of 8.8 reflects: Attack Vector (Network) = unrestricted remote access, Attack Complexity (Low) = no special conditions needed, Privileges Required (None) = attacker needs no authentication, User Interaction (Required) = user must visit a malicious page, Scope (Unchanged) = impact limited to the vulnerable component, and Confidentiality/Integrity/Availability (all High) = arbitrary code execution enables theft, modification, and denial of service. The sandbox containment prevents kernel-level compromise but does not reduce the score because code execution within the browser process is sufficient for data theft and malware delivery.

Frequently asked questions