CVE-2026-10886: Use after free in FileSystem in Google Chrome prior to 149

Synopsis

Use-after-free in the FileSystem component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to exploit freed memory by luring a victim to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though the victim must visit an attacker-controlled page. Successful exploitation enables a sandbox escape, giving the attacker full read, write, and availability impact beyond Chrome's sandboxed environment. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credentials are needed on the targeted system; any anonymous visitor can be targeted.

• Victim interactionRequired

  The victim must visit the attacker-controlled HTML page, requiring a social-engineering step such as a phishing link or malicious ad.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• The attacker escapes Chrome's sandbox, gaining code execution in the context of the browser process on the victim host.
• Confidential data accessible to the browser process, including stored credentials, cookies, and session tokens, is readable by the attacker.
• The attacker can write to or modify files and data accessible to the browser process, including persistent browser state.
• The browser process and any dependent services can be crashed or disrupted, causing a denial of service for the affected user.