CVE-2026-10901: Use after free in Passwords in Google Chrome on Mac prior to 149

Synopsis

A use-after-free vulnerability exists in the Passwords component of Google Chrome on macOS in versions prior to 149.0.7827.53. The flaw is reachable over the network but requires the attacker to convince a target user to perform specific UI gestures, and no prior authentication is needed. Successful exploitation gives the attacker arbitrary code execution inside the Chrome process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network via a crafted HTML page, so the target host must be able to reach and render attacker-controlled web content.

• AuthenticationNot required

  No account or credential is needed; the attacker operates as an unauthenticated remote party.

• Victim interactionRequired

  The attacker must socially engineer the target user into performing specific UI gestures inside Chrome before the vulnerable code path is triggered.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account for timing, memory layout, or other environmental conditions that cannot be reliably controlled, making reliable exploitation harder to achieve.

Blast Radius

• A successful attacker executes arbitrary code within the Chrome process on the target macOS host.
• Code execution at Chrome's privilege level exposes all data the browser can access, including stored passwords, session cookies, and browsing history.
• The attacker can read, modify, or exfiltrate any file or credential that Chrome has permission to reach on the local filesystem.
• The running Chrome process can be crashed or hijacked, disrupting browser availability for the affected user.