CVE-2026-10893: Use after free in Chromoting in Google Chrome prior to 149

Synopsis

Use-after-free vulnerability in the Chromoting component of Google Chrome allows a remote attacker to execute arbitrary code by sending malicious network traffic to a vulnerable browser. The attacker needs no authentication but does require the victim to interact with a malicious resource, as reflected in the CVSS vector (AV:N, PR:N, UI:R). Successful exploitation gives the attacker full control over the browser process, enabling data theft, file tampering, and service disruption. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network, making any internet-exposed or network-reachable Chrome instance a valid target.

• AuthenticationNot required

  No account or credential is needed; the attacker sends malicious network traffic without authenticating to any service.

• Victim interactionRequired

  The victim must take an action such as visiting a malicious page or opening a crafted link, introducing a social-engineering step the attacker must clear.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory-layout prerequisites.

Blast Radius

• A successful attacker executes arbitrary code inside the Chrome renderer or browser process on the victim's machine.
• The attacker reads data accessible to the Chrome process, including stored session tokens, saved passwords, and browsing history.
• The attacker modifies files and browser-stored data writable by the Chrome process, including cookies, local storage, and downloaded files.
• The attacker can crash or hang the Chrome process, denying the victim access to browser-dependent workflows.