CVE-2026-10902: Use after free in Ozone in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the Ozone display platform layer of Google Chrome (versions before 149.0.7827.53) allows a remote attacker to execute arbitrary code. The vulnerability is reachable over the network and requires no authentication, but the targeted user must visit a crafted HTML page. Successful exploitation gives the attacker full code execution inside the Chrome renderer process, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the target to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account credentials or prior authentication to any service are needed to deliver the malicious page.

• Victim interactionRequired

  The targeted user must open or be redirected to the attacker's crafted HTML page in the affected Chrome browser.

• Attack complexityDetail

  Exploit conditions are reliable and free of race conditions or special environmental dependencies, making the attack straightforward to carry out once the victim visits the page.

Blast Radius

• Attacker achieves arbitrary code execution inside the Chrome renderer process, enabling full control over the browser's content sandbox.
• All data loaded in the active browser session, including stored credentials, session tokens, and page content, is readable by the attacker.
• The attacker can write or modify data accessible to the renderer, including form submissions, local storage, and in-page state.
• The affected Chrome process can be crashed or made unresponsive, disrupting the user's browser session.