CVE-2026-10887: Use after free in Chromoting in Google Chrome on Mac prior to 149

Synopsis

A use-after-free vulnerability in the Chromoting (Chrome Remote Desktop) component of Google Chrome on macOS allows a remote attacker to execute arbitrary code by sending malicious network traffic. No authentication or victim interaction is required, though the attacker must win a race condition or meet specific environmental prerequisites to reliably trigger the memory corruption. Successful exploitation gives the attacker full code execution within the Chrome process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network by sending crafted traffic to the Chromoting service; no local or physical access is needed.

• AuthenticationNot required

  No account credentials or session token are needed; the exploit path is fully unauthenticated.

• Victim interactionNot required

  The vulnerability is triggered purely through inbound network traffic; the user on the target machine does not need to click, open, or approve anything.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must satisfy specific race-condition timing or memory-layout prerequisites rather than firing a simple, unconditional payload.

Blast Radius

• A successful attacker achieves arbitrary code execution inside the Chrome process on the target Mac, giving full control over what that process can read and write.
• Confidential data accessible to Chrome, including stored credentials, session cookies, and browsing history, is exposed to the attacker.
• The attacker can modify in-memory state and on-disk data that Chrome has write access to, including profile data and downloaded files.
• The Chrome process can be crashed or kept running under attacker control, either disrupting the remote-desktop session or silently maintaining persistence.