CVE-2026-10895: Use after free in Ozone in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Ozone graphics layer of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code by luring a user to a crafted HTML page. The vulnerability is reachable over the network with no authentication required, but does require the victim to open a malicious page in their browser. Successful exploitation gives the attacker full code execution within the browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by hosting a crafted HTML page, so the victim's browser must be able to reach attacker-controlled content on the internet or an internal network.

• AuthenticationNot required

  No account or credential is needed on the target system; any user who visits the malicious page is at risk.

• Victim interactionRequired

  The victim must actively open or be redirected to a crafted HTML page, requiring a social-engineering or phishing step by the attacker.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Attacker gains arbitrary code execution inside the Chrome renderer or browser process on the victim host.
• Confidentiality impact is high: the attacker can read browser session tokens, saved credentials, cookies, and locally accessible files reachable by the browser process.
• Integrity impact is high: the attacker can write or modify files and data accessible to the browser process, including cached content and profile data.
• Availability impact is high: the attacker can crash or hang the browser process, disrupting the user's session entirely.