Quick Look: Google Chrome XR Use After Free RCE (CVE-2026-9118)

Introduction

A use-after-free vulnerability in Google Chrome's XR component on Windows lets remote attackers execute arbitrary code simply by luring a user to a malicious web page. Chrome has over 68 percent of the global browser market and an estimated 4.16 billion users, so the exposure is significant, and security teams managing Windows endpoints should act on CVE-2026-9118 promptly.

Technical Information

CVE-2026-9118 is classified under CWE-416 (Use After Free) and has a CVSS base score of 8.8. The flaw is in Chrome's XR component, which implements the WebXR Device API that the browser uses for augmented reality and virtual reality experiences.

Root Cause

A use-after-free condition occurs when an application keeps referencing a pointer after the memory behind it has been freed or reallocated. If an attacker can influence what ends up in the freed memory region (for example, with a heap spray or a carefully timed allocation), they can corrupt internal data structures and hijack the program's control flow to execute arbitrary code.

In CVE-2026-9118, the memory mismanagement happens in the XR subsystem of the Chromium rendering engine. The exact objects, classes, or functions involved have not been disclosed publicly. Google tracks the issue internally as Chromium issue 498702233. Access to that issue is likely restricted until enough of the user base has updated.

Attack Flow

Based on the available advisory information, exploitation follows the familiar path for browser-based use-after-free vulnerabilities:

1. The attacker hosts or injects a crafted HTML page that exercises the vulnerable XR code path.
2. The victim navigates to the malicious page, either directly or through a redirect from a compromised or attacker-controlled site.
3. Chrome's rendering engine processes the page content and invokes the XR component.
4. The crafted content triggers the use-after-free condition, and Chrome dereferences a dangling pointer.
5. The attacker uses control over the freed memory region to execute arbitrary code in the context of the Chrome renderer process.

No published proof-of-concept exploit code appears in any of the reviewed sources. A deeper root cause analysis, including the specific functions and object lifecycles involved, has not been disclosed yet.

Affected Systems and Versions

The vulnerability affects Google Chrome on Windows. The table below lists the affected and fixed versions for each platform:

The CVE description names Windows as the affected platform, but Google's stable channel update also ships matching fixes for macOS and Linux. Because the advisory names Windows explicitly, patch Windows endpoints first.

To confirm Chrome is updated, open Help > About Google Chrome. The page forces a version check and shows the build number currently installed.

Vendor Security History

Google runs one of the more aggressive patch cadences in the industry for browser security. The Chrome 148 release that fixes CVE-2026-9118 is unusually large. It resolves 127 security vulnerabilities in one update, more than twice as many as the previous version fixed. Those 127 fixes include three critical-severity flaws and many high-, medium-, and low-severity issues.

Google paid $138,000 in bug bounties to external researchers for the vulnerabilities resolved in this update cycle. The payouts reflect the company's continued investment in its Vulnerability Reward Program, which Google uses to find and fix security issues before they are exploited.

References

• NVD Entry for CVE-2026-9118
• CVE Record: CVE-2026-9118
• Chrome Stable Channel Update for Desktop (May 2026)
• Chromium Issue 498702233
• Forbes: Critical New Google Update, 127 Chrome Security Vulnerabilities Confirmed
• PCWorld: Chrome 148 Patches 100+ Vulnerabilities Including 3 Critical Flaws
• Backlinko: Web Browser Market Share Statistics