Google Chrome GPU Use-After-Free: Remote Code Execution via Crafted HTML

The National Vulnerability Database has disclosed CVE-2026-9112, a high-severity use-after-free vulnerability in the GPU component of Google Chrome on Windows. This flaw, present in versions prior to 148.0.7778.179, allows a remote attacker to execute arbitrary code within the browser’s sandbox. The attack vector is a crafted HTML page, meaning a user simply visiting a malicious website could trigger the exploit.

This is a critical client-side vulnerability. The attacker’s calculus here is straightforward: web browsers are universal. A successful exploit bypasses the browser’s sandbox, a fundamental security control, and could lead to system compromise. Such vulnerabilities are prime targets for initial access in sophisticated attacks, including watering-hole campaigns or phishing-driven exploits.

Defenders need to prioritize patching. While the sandbox offers some containment, a successful use-after-free can lead to information disclosure or full system compromise. The high CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) underscores the ease of exploitation (low attack complexity, no privileges required, user interaction via a click) and the severe impact (high confidentiality, integrity, and availability compromise). This isn’t just a crash; it’s a doorway.