CVE-2026-10899: Use after free in Ozone in Google Chrome on Linux prior to 149

Synopsis

A use-after-free vulnerability affects the Ozone graphics platform layer in Google Chrome on Linux, in versions prior to 149.0.7827.53. The flaw is reachable over the network but requires a victim to perform specific UI gestures on a crafted HTML page, and no authentication is needed from the attacker. Successful exploitation corrupts heap memory, giving an attacker the ability to read sensitive data, tamper with browser memory, or execute arbitrary code in the renderer process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome on Linux.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable or the victim must browse to an attacker-controlled URL.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the victim to visit a page.

• Victim interactionRequired

  Exploitation requires the victim to perform specific UI gestures on the crafted page, meaning the attacker must socially engineer that interaction.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit depends on environmental or timing factors such as heap layout conditions that the attacker cannot fully control.

Blast Radius

• A successful exploit reads high-confidentiality browser memory, exposing stored session tokens, credentials, or page content from the current browser context.
• The attacker can modify in-process memory, altering rendered page state or injecting behavior into the running Chrome process.
• Heap corruption at this severity can crash the affected Chrome process, disrupting any active browsing session or web-based workflow running under it.
• Depending on sandbox posture of the container image, arbitrary code execution inside the renderer may be achievable, extending attacker control beyond the browser tab.