CVE-2026-10891: Use after free in GFX in Google Chrome on Linux prior to 149

Synopsis

Use-after-free in the GFX (graphics) component of Google Chrome on Linux, affecting all versions prior to 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but does require a user to visit or be redirected to a crafted HTML page. Successful exploitation causes heap corruption that gives the attacker full read, write, and execution control over the affected browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be able to load an attacker-controlled or attacker-influenced HTML page via a standard HTTP/HTTPS request.

• AuthenticationNot required

  No account, credential, or session token is needed; any anonymous network request that causes the browser to render the crafted page is sufficient.

• Victim interactionRequired

  The targeted user must visit or be navigated to a crafted HTML page, making this a social-engineering or malicious-redirect scenario.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions, race conditions, or memory-layout prerequisites are required; the attack is condition-free once the page is loaded.

Blast Radius

• Reads the contents of the browser process memory, exposing stored session tokens, credentials cached by the browser, and page content from other open tabs.
• Writes arbitrary data into heap memory, allowing the attacker to alter application state or inject code into the running process.
• Achieves code execution within the Chrome renderer or browser process on the affected Linux host.
• Crashes or destabilizes the browser process, disrupting availability for the affected user session.