CVE-2026-10890: Use after free in Cast in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Cast component of Google Chrome prior to version 149.0.7827.53 allows an attacker on the same local network segment to exploit heap corruption without any authentication or user interaction. The flaw is reachable by sending malicious network traffic to an affected Chrome instance, and successful exploitation grants full confidentiality, integrity, and availability impact over the browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same local network segment, LAN, or VPN as the target; remote internet-based exploitation is not possible without that adjacency.

• AuthenticationNot required

  No credentials or account are needed; the attacker sends malicious traffic anonymously over the adjacent network.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is required for exploitation to succeed.

• Attack complexityDetail

  The exploit is reliable and requires no special pre-conditions, race conditions, or environmental factors beyond network adjacency.

Blast Radius

• A successful attacker reads browser memory contents, including session tokens, saved credentials, and any in-memory page data from the compromised Chrome process.
• The attacker can write to or corrupt heap memory within the Chrome process, modifying in-flight data or persisted browser state such as cookies and local storage.
• The exploit crashes or destabilizes the Chrome process, causing a denial of service for the affected user session.
• Heap corruption of this class frequently serves as a stepping stone to arbitrary code execution within the Chrome sandbox, enabling further exploitation of sandbox escapes.