CVE-2026-10882: Use after free in Network in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability exists in the Network component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives an attacker arbitrary code execution in the context of the Chrome process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential is needed; the attacker requires no prior authentication to the targeted service or system.

• Victim interactionRequired

  The victim must actively visit or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race wins, or memory-layout assumptions.

Blast Radius

• A successful attacker achieves arbitrary code execution inside the Chrome process, enabling them to run attacker-supplied instructions on the victim host.
• Confidentiality impact is high: the attacker can read data accessible to the Chrome process, including stored credentials, session tokens, and browser-accessible files.
• Integrity impact is high: the attacker can write or modify data on the host, including files, registry entries, or other resources reachable from the browser process.
• Availability impact is high: the attacker can crash or permanently disrupt the affected Chrome instance and any dependent services or workflows.