CVE-2026-10903: Use after free in WebRTC in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in the WebRTC component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the browser sandbox. The vulnerability is reachable over the network with no authentication required, but the victim must visit a crafted HTML page. Successful exploitation gives an attacker code execution within the Chrome sandbox, which combined with a sandbox escape could lead to full system compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a crafted HTML page hosted on an attacker-controlled or compromised site.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering-dependent attack that requires the attacker to direct or trick the user into opening the malicious URL.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• An attacker gains arbitrary code execution inside the Chrome renderer sandbox, allowing them to run attacker-controlled instructions within the browser process.
• Confidential data processed by the browser tab (session tokens, form inputs, page content) is readable by the attacker.
• The attacker can tamper with page content and in-browser state, enabling credential theft, session hijacking, or redirection of subsequent requests.
• If chained with a sandbox escape, the attacker can extend control beyond the browser to the underlying host operating system.