CVE-2026-10900: Use after free in Passwords in Google Chrome on Mac prior to 149

Synopsis

A use-after-free vulnerability in the Passwords component of Google Chrome on macOS allows a remote attacker to corrupt heap memory. Exploitation requires luring a user into specific UI interactions on a crafted HTML page, and no authentication to the Chrome instance is needed. Successful exploitation gives the attacker full read, write, and execution-level capability over the browser process, enabling data theft, modification of in-memory state, or arbitrary code execution. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a crafted HTML page to the victim over the network, so the Chrome instance must be reachable or the user must browse to attacker-controlled content.

• AuthenticationNot required

  No authentication to the browser or any backing service is required; the attacker only needs the victim to visit a crafted page.

• Victim interactionRequired

  The attacker must convince the user to perform specific UI gestures within the browser, making this a social-engineering-dependent exploit.

• Attack complexityDetail

  Attack complexity is high, meaning the exploit depends on environmental or timing factors such as precise heap layout or race conditions that the attacker cannot fully control.

Blast Radius

• Reads stored passwords and session tokens held in the Chrome Passwords component at the time of exploitation.
• Modifies in-memory browser state, allowing the attacker to alter page content or intercept credentials before they are written to disk.
• Executes arbitrary code within the Chrome renderer or browser process on the affected macOS host.
• Crashes the affected Chrome process if heap corruption is not precisely controlled, causing a denial of service for the user.