CVE-2026-10000: Use after free in Passwords in Google Chrome on Windows prior to 148

Synopsis

Use-after-free in the Passwords component of Google Chrome on Windows (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the browser renderer process to escape the Chrome sandbox by delivering a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though the attacker must first achieve renderer compromise and persuade a user to visit a malicious page. Successful exploitation gives the attacker full control outside the sandbox, enabling arbitrary code execution, data theft, and system tampering at the level of the browser process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No authentication or account credentials are required; the attacker operates as an anonymous remote party.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Exploitation is high-complexity because it requires a precondition of renderer process compromise before the sandbox-escape primitive can be triggered.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code at the privilege level of the browser process on the Windows host.
• Confidential data accessible to the browser, including saved passwords, session cookies, and locally cached files, is readable by the attacker.
• Attacker can write or modify files and registry keys that the browser process has access to, altering persisted application state.
• The browser process and any dependent services can be crashed or destabilized, disrupting the user's session and any locally running workloads.