CVE-2026-10894: Use after free in Printing in Google Chrome on Linux prior to 149

Synopsis

A use-after-free vulnerability exists in the Printing component of Google Chrome on Linux in versions prior to 149.0.7827.53. The flaw is reachable over the network but requires victim interaction and a pre-compromised renderer process; an attacker delivers a crafted HTML page to trigger the condition. Successful exploitation enables a sandbox escape, giving the attacker capabilities beyond the Chrome renderer sandbox, including potential code execution on the host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target host must be reachable by or be browsing content from an attacker-controlled origin.

• AuthenticationNot required

  No account or credential is needed; the attack is launched through a crafted web page served to an unauthenticated user.

• Victim interactionRequired

  A user must open or be redirected to the attacker's crafted HTML page, making social engineering or a drive-by redirect a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is high because the attacker must already have compromised the Chrome renderer process before triggering the use-after-free to escape the sandbox, introducing a significant pre-condition.

Blast Radius

• The attacker escapes the Chrome renderer sandbox, breaking the security boundary that isolates browser processes from the underlying Linux host.
• With sandbox escape achieved, the attacker gains the ability to execute arbitrary code in the context of the browser process on the host system.
• Host file system paths accessible to the Chrome process become readable, exposing stored credentials, cookies, and session tokens held on disk.
• Data integrity on the host is at risk: the attacker can write or modify files within the process's permissions, and the process itself can be crashed or destabilized.