CVE-2026-7984: Google Chrome Use After Free Vulnerability

CVE-2026-7984 Overview

CVE-2026-7984 is a use-after-free vulnerability in the ReadingMode component of Google Chrome prior to version 148.0.7778.96. An attacker who has already compromised the renderer process can leverage this flaw to execute arbitrary code within the Chrome sandbox via a crafted HTML page. The vulnerability is tracked under [CWE-416] and affects Chrome installations across Windows, macOS, and Linux. Google classifies the Chromium security severity as Medium, while NVD assigns a higher CVSS rating due to the network-based attack vector and high impact on confidentiality, integrity, and availability.

Critical Impact
Successful exploitation enables arbitrary code execution inside the Chrome renderer sandbox, providing a foothold that can be chained with sandbox escape vulnerabilities for full system compromise.

Affected Products

Google Chrome prior to 148.0.7778.96 on Microsoft Windows
Google Chrome prior to 148.0.7778.96 on Apple macOS
Google Chrome prior to 148.0.7778.96 on Linux

Discovery Timeline

2026-05-06 - CVE CVE-2026-7984 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-7984

Vulnerability Analysis

The vulnerability resides in Chrome's ReadingMode feature, which reformats web pages into a simplified, distraction-free layout. ReadingMode parses Document Object Model (DOM) content and maintains references to underlying objects during transformation. A use-after-free condition occurs when ReadingMode retains a pointer to memory that has already been deallocated by another component of the renderer.

When the freed memory is later reallocated and controlled by attacker-supplied data, the dangling pointer enables attacker-controlled code paths. This translates into arbitrary code execution within the renderer sandbox.

The vulnerability requires user interaction, meaning the victim must visit a crafted HTML page. The attacker must also have already compromised the renderer process, typically through a separate flaw, before triggering this issue. Chained with a sandbox escape, this primitive becomes part of a full remote code execution exploit chain.

Root Cause

The root cause is improper object lifetime management in the ReadingMode implementation. ReadingMode holds a raw or weakly tracked reference to a DOM object that is destroyed during page transitions or document mutations. Subsequent access through the stale pointer triggers undefined behavior. This is a textbook [CWE-416] Use After Free pattern common in browser engine components that mediate between rendering pipelines and document state.

Attack Vector

Exploitation requires a multi-stage approach. The attacker first delivers a crafted HTML page to the victim, who must load the page in a vulnerable Chrome build. Initial renderer compromise is required, which typically leverages a separate memory corruption flaw. Once the renderer is under attacker control, the ReadingMode use-after-free is triggered to execute attacker-controlled code paths inside the sandboxed process. Refer to the Chromium Issue Tracker Entry for additional technical context.

Detection Methods for CVE-2026-7984

Indicators of Compromise

Chrome renderer processes crashing with access violation or segmentation fault errors referencing ReadingMode code paths
Unexpected child processes spawned from chrome.exe shortly after a user opens a web page in ReadingMode
Outbound network connections from Chrome renderer processes to uncategorized or newly registered domains
Browser telemetry showing repeated visits to pages that immediately trigger ReadingMode activation

Detection Strategies

Monitor endpoint telemetry for Chrome renderer process crashes correlated with READING_MODE or chrome_render_frame stack frames
Inspect process trees for anomalous descendants of Chrome renderer sandboxed processes
Apply behavioral analytics to flag renderer processes performing file system writes outside the standard Chrome profile directories
Correlate web proxy logs with endpoint browser version data to identify users running Chrome builds prior to 148.0.7778.96

Monitoring Recommendations

Inventory installed Chrome versions across the fleet and prioritize upgrade for hosts on builds earlier than 148.0.7778.96
Enable verbose Chrome crash reporting and forward dumps to central analysis platforms
Track DNS and HTTP traffic from browser processes for connections to known exploit kit infrastructure
Alert on combinations of renderer crashes followed by suspicious child process creation within a short time window

How to Mitigate CVE-2026-7984

Immediate Actions Required

Update Google Chrome to version 148.0.7778.96 or later on all Windows, macOS, and Linux endpoints
Force-restart Chrome instances after deployment to ensure the patched binaries are loaded
Audit enterprise Chrome management policies to confirm automatic updates are not disabled
Block or restrict access to untrusted external sites for users on legacy Chrome builds until patching completes

Patch Information

Google released the fix in the Stable channel update for Chrome 148.0.7778.96. Details are available in the Google Chrome Desktop Update advisory. Enterprise administrators using Chrome Browser Cloud Management or group policy should validate that the update has been applied to all managed devices.

Workarounds

Disable ReadingMode via enterprise policy where supported until the patch is deployed
Restrict Chrome usage to trusted sites through web proxy allow-listing for high-risk users
Enforce site isolation and strict sandbox flags through enterprise policy to limit renderer process privileges
Apply network egress controls on endpoints to limit post-exploitation command and control options

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Expected output: Google Chrome 148.0.7778.96 or later

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version