CVE-2026-10013: Use after free in WebCodecs in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the WebCodecs component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, but does require the victim to visit a malicious page. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential on the target system is needed; the exploit is available to any unauthenticated remote attacker.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must socially engineer or redirect the victim to open it in a vulnerable Chrome browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond the victim visiting the page.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining control of the sandboxed process.
• With sandbox escape primitives or browser bugs chained together, the attacker reads sensitive in-browser data including session tokens, form contents, and cached credentials.
• The attacker modifies page content and intercepts or tampers with data the victim submits through the browser.
• The attacker can crash or destabilize the affected browser process, denying the victim access to browser-based services.