Use after free in QUIC in Google Chrome on prior to 148

CVE-2026-9114 is a CWE-416 use-after-free in Chrome’s QUIC/HTTP3 networking stack. Google’s CVE record says Chrome versions prior to 148.0.7778.179 are affected; the May 19, 2026 desktop release shipped 148.0.7778.178/179 for Windows/Mac and 148.0.7778.178 for Linux, so defenders need to rely on vendor packaging rather than assume every platform reports the exact same build string. The bug is reachable by malicious network traffic, which in practice means a victim browser has to talk QUIC to attacker-controlled content.

Vendor HIGH 8.8 overstates the enterprise urgency if you read it like host-level RCE. The important clause is *inside a sandbox*: this is code execution in a constrained browser process, not a sandbox escape, and there is no KEV entry, no public exploitation evidence in the cited sources, and a supplied EPSS of 0.0003 (0.03%). That keeps it real, but not fire-drill real.

Why this verdict

• Downgrade for sandbox-only impact: the public advisory explicitly says code execution occurs *inside a sandbox*, so vendor CVSS overstates endpoint-compromise reality unless this is chained with a second bug.
• Downgrade for reachability friction: exploitation requires a user-driven browser session over QUIC/HTTP3, and many enterprises reduce that path with proxies, browser policy, or UDP/443 blocking.
• Downgrade for missing threat signal: no KEV listing, CISA ADP says Exploitation: none, supplied EPSS is 0.0003, and no public PoC was found in the cited sources.
• Keep it above LOW because Chrome is everywhere: this is still unauthenticated remote memory corruption in a massively deployed client, so once users browse attacker content the pre-auth portion of the chain is straightforward.

Why not higher?

If this were a sandbox escape, or if there were active exploitation, a public exploit chain, or clear bypass of common enterprise QUIC controls, this would move up fast. As published, the blast radius is capped by the browser sandbox and by the fact that the attacker still needs user browsing behavior plus QUIC reachability.

Why not lower?

This is not harmless parser weirdness; it is real memory corruption with arbitrary code execution in browser context. Chrome’s install base is enormous, and browser-context code execution can still steal session material, abuse web permissions, or become the first leg of a two-bug chain.

1. Force browser auto-update and relaunch — Use Chrome Enterprise, MDM, RMM, or package management to push fixed builds and enforce restart prompts. For a MEDIUM noisgate verdict there is no mitigation SLA; use this as routine control hygiene and complete the actual patch inside the 365-day remediation window.
2. Disable QUIC on lagging fleets — If you have unmanaged or hard-to-restart endpoints, disable Chrome QUIC/HTTP3 by policy or block UDP/443 at egress to remove the vulnerable transport path. For MEDIUM, there is no mitigation SLA; treat this as an interim reduction measure while normal patch rollout catches up.
3. Prioritize high-risk browsing populations — Apply version enforcement first to users who browse untrusted external content heavily: researchers, executives, sales, support, and contractor populations. Even without a mitigation SLA, this narrows the real attack surface early inside the same 365-day remediation window.
4. Inventory unmanaged Chromium variants — Query EDR/software inventory for Chrome, Chromium, Edge-derived testing builds, VDI gold images, and kiosk systems that miss normal browser cadence. This matters because client-side browser exposure is usually in the long tail, not the managed majority.

Run this on the target endpoint or through your fleet execution tool. Invoke it with python3 check_cve_2026_9114.py; no admin rights are usually required, but Windows registry reads are more reliable from a normal user session on the local host. The script checks common Chrome install paths and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_cve_2026_9114.py
# Determine whether Google Chrome on this host is vulnerable to CVE-2026-9114.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (148, 0, 7778, 179)


def norm(v):
    nums = [int(x) for x in re.findall(r'\d+', v)]
    while len(nums) < 4:
        nums.append(0)
    return tuple(nums[:4])


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_versions():
    versions = []
    reg_paths = [
        r'HKLM\SOFTWARE\Google\Chrome\BLBeacon',
        r'HKLM\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
        r'HKCU\SOFTWARE\Google\Chrome\BLBeacon',
    ]
    for path in reg_paths:
        out = run_cmd(['reg', 'query', path, '/v', 'version'])
        m = re.search(r'version\s+REG_\w+\s+([0-9\.]+)', out, re.I)
        if m:
            versions.append(('Google Chrome', m.group(1), path))

    exe_paths = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for exe in exe_paths:
        if os.path.exists(exe):
            out = run_cmd([exe, '--version'])
            m = re.search(r'(\d+\.\d+\.\d+\.\d+)', out)
            if m:
                versions.append(('Google Chrome', m.group(1), exe))
    return versions


def get_macos_versions():
    versions = []
    apps = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for app in apps:
        if os.path.exists(app):
            out = run_cmd([app, '--version'])
            m = re.search(r'(\d+\.\d+\.\d+\.\d+)', out)
            if m:
                versions.append(('Google Chrome', m.group(1), app))
    return versions


def get_linux_versions():
    versions = []
    bins = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    for b in bins:
        out = run_cmd([b, '--version'])
        m = re.search(r'(\d+\.\d+\.\d+\.\d+)', out)
        if m:
            versions.append((b, m.group(1), b))
    return versions


def main():
    system = platform.system().lower()
    found = []

    if 'windows' in system:
        found = get_windows_versions()
    elif 'darwin' in system:
        found = get_macos_versions()
    elif 'linux' in system:
        found = get_linux_versions()
    else:
        print('UNKNOWN - unsupported platform: {}'.format(platform.system()))
        sys.exit(2)

    if not found:
        print('UNKNOWN - Google Chrome/Chromium not found in common locations')
        sys.exit(2)

    vulnerable = []
    patched = []

    for name, ver, src in found:
        nver = norm(ver)
        if cmp_ver(nver, FIXED) < 0:
            vulnerable.append((name, ver, src))
        else:
            patched.append((name, ver, src))

    # Prefer a vulnerable finding if any matching browser is below the fixed version.
    if vulnerable:
        details = '; '.join(['{} {} [{}]'.format(n, v, s) for n, v, s in vulnerable])
        print('VULNERABLE - found version(s) below {}: {}'.format('.'.join(map(str, FIXED)), details))
        sys.exit(1)

    details = '; '.join(['{} {} [{}]'.format(n, v, s) for n, v, s in patched])
    print('PATCHED - found version(s) at or above {}: {}'.format('.'.join(map(str, FIXED)), details))
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (May 19, 2026)
2. NVD - CVE-2026-9114
3. OpenCVE - CVE-2026-9114
4. Chromium issue 495798630
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS
7. Debian security tracker - chromium source package
8. Ubuntu CVE tracker search results including CVE-2026-9114