CVE-2026-10888: Use after free in Cast Streaming in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Cast Streaming component of Google Chrome (versions prior to 149.0.7827.53) allows an attacker on the same local network segment to execute arbitrary code by sending malicious network traffic to the browser. No authentication and no victim interaction are required; the attacker only needs to share the local network, LAN, or VPN with the target. Successful exploitation gives the attacker full code execution inside the Chrome renderer process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment, LAN, or VPN as the target; remote over-the-internet exploitation is not possible with this vector (AV:A).

• AuthenticationNot required

  No account or credential of any kind is required before the attack can be launched (PR:N).

• Victim interactionNot required

  The exploit is delivered entirely through malicious network traffic and requires no action from the user (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special memory-layout requirements must be satisfied (AC:L).

Blast Radius

• The attacker achieves arbitrary code execution inside the Chrome renderer process on the target host.
• All data accessible to the browser process, including stored session tokens, cookies, and cached credentials, is readable by the attacker (C:H).
• The attacker can write or modify data accessible to the browser process, including saved passwords and local storage contents (I:H).
• The attacker can crash or hang the affected Chrome process, disrupting the user's browser session (A:H).